There are advantages to the DORA bill

Juliette Juffermans, Business Analyst at ISPnext: "DORA (Digital Operational Resilience Act) was introduced in 2023 and will become fully effective this year. DORA applies to all organisations active in the financial sector, as well as IT service providers that serve such institutions within the EU."

"Compliance with DORA has a number of advantages. For example, it makes the ICT supply chain transparent, and fixed processes are established for both ICT work and for employees in the event of incidents."

Advantages of DORA

The advantages of the DORA legislation at a glance:

Enhanced transparency
DORA sets out a high number of risk management requirements that apply to ICT partners. For example, the organisation should provide an overview of its suppliers and the sub-tier supplier network. DORA thus forces the organisation to more rigorously check the outsourcing chain and critical ICT suppliers. This results in making stricter and safer choices in respect of current and new partnerships. This improves information exchange and transparency in the supply chain.

Automated processes
Thanks to the DORA framework, it is clear which documentation and data needs to be provided. This requirement list and query process can be largely automated to ensure that data is delivered in a timely manner, allowing the organisation to focus more on assessing the delivered data.

Reinforcing the supply chain through mandatory disclosure
It is mandatory to disclose any incidents that have an impact on the financial institution's service provision. This enables the company to keep its grip on and overview of the supply chain and allows for quick action.

Enhanced compliance
Detailed continuity plans are designed to ensure uninterrupted continuation of ICT services. Compliance is enhanced and administration is improved through the DORA framework. Financial institutions must implement a testing programme involving various vulnerability scans and (physical) security tests.

Better monitoring of security
To monitor the supply chain, every new ICT agreement should be recorded. This involves setting up a log that keeps track of which ICT suppliers and sub-tiers signed agreements with the organisation. This allows for greater transparency in the supply chain and early detection of any disruptions.

"Compliance is enhanced and administrative systems are improved by applying the DORA framework.”

- Juliette Juffermans, Business Analyst | ISPnext

Making DORA compliance easy with integrated supplier and contract management

ISPnext facilitates an environment where data from suppliers and the sub-tier supplier network can be captured in accordance with the DORA format and printed out as a valid report. Vendor Management allows for recording information about the organisation as such. Supplier data can be collected and insights are generated by mapping the ICT supply chain. In addition, contracts can be created in Contract Management in full compliance with the DORA framework. Contracts generated this way can then be linked into the supplier (chain) in Vendor Management.

The Supplier Portal and fixed templates enable the organisation to easily track and update supplier and contract information. The Supplier Portal allows for requesting information from the supplier based on questionnaires.

ISPnext enables organisations to become DORA compliant. This way, an organisation can focus on its core activities, saving costs by collecting data efficiently and getting incidents viewable and resolved faster. Finally, it ensures that your risks are transparent and understood.