cybersecurity Glossary

What is DORA?

The Digital Operational Resilience Act (DORA) is a regulation by the European Union designed to ensure that financial entities can withstand and quickly recover from cyberattacks. DORA requires banks and other financial institutions to adopt robust digital security measures. This includes identifying technological risks, implementing protection strategies, and preparing response and recovery plans for incidents. The aim is to minimize incident response times and to maintain operational stability and public confidence in the European financial system.

DORA also establishes notification obligations for major incidents to improve coordinated responses between authorities and financial entities. Organizations must report any significant incident to authorities through an initial notification, an intermediate report, and a final report analyzing the cause and impact of the incident. This centralized communication will help identify and address critical vulnerabilities within the sector. DORA standardizes notifications and mandates that competent authorities supervise financial entities according to their relevance and risk profile, reinforcing the protection of the financial system.

Furthermore, DORA extends its cybersecurity resilience requirements to external ICT service providers, including cloud services, which are essential to the sector’s operations. These critical providers will be subject to EU oversight and must comply with high security standards to prevent weaknesses in the digital supply chain of financial institutions. In this way, DORA aims not only to strengthen the response capabilities of financial institutions but also to promote a resilient technological infrastructure across the European Union, in alignment with other cybersecurity regulations such as NIS2.

Threat Hunting: A managed service (MDR) that aims to proactively detect and contain threats and suspicious activities on the network by utilizing the telemetry data generated by EDR and XDR technology, and following the methodology defined in the MITRE ATT&CK framework.

Incident response: Incident response is a managed service that helps organizations respond to security incidents. It is activated when an incident occurs and aims to identify and contain the malicious actor and recover the affected systems and data.

TLPT: One of DORA’s key pillars is conducting Threat-Led Penetration Testing (TLPT) exercises, which are offensive Red Team tests driven by threat intelligence to assess and improve detection and response capabilities in the event of a targeted attack.