What It Is

Digital Operational Resilience Act (DORA), formally Regulation (EU) 2022/2554, is an EU-wide regulation bolstering digital resilience in the financial sector against ICT disruptions like cyberattacks and third-party failures. It applies from January 17, 2025, to 20 financial entity types and critical ICT providers, using a risk-based, proactive approach for harmonized oversight.

Key Components

• **ICT Risk Management FrameworksIdentify, assess, mitigate risks with management oversight and proportionality.
• **Incident ReportingLog, classify, report major incidents within 4 hours initially, 72 hours intermediate, 1-month root cause.
• **Resilience TestingAnnual basic tests, triennial TLPT for critical functions.
• **Third-Party Risk OversightDue diligence, monitoring, ESAs supervision of CTPPs. Built on four pillars; compliance via penalties up to 2% turnover, no formal certification.

Why Organizations Use It

Mandated for EU financial firms (~22,000 entities) to avoid fines, mitigate systemic cyber risks (74% ransomware hit), enhance resilience post-outages like CrowdStrike. Builds trust, streamlines cross-border compliance, drives cybersecurity investments (€10-15B EU-wide).

Implementation Overview

Conduct gap analyses per RTS/ITS, develop frameworks/tools, train staff, test resilience. Tailored by size/complexity; ongoing for all EU financial entities/third-parties. Authorities enforce via audits, reporting by 2025 deadline.

What It Is

BREEAM (Building Research Establishment Environmental Assessment Method) is a science-led sustainability certification framework for the built environment. Developed by BRE in 1990, it assesses environmental, social, and resilience performance across buildings, infrastructure, and communities. Its credit-based methodology organizes requirements into categories, weighted by impact, yielding ratings from Pass to Outstanding.

Key Components

• Core categories: Management, Health & Wellbeing, Energy, Transport, Water, Materials, Waste, Land Use & Ecology, Pollution, Innovation (10 main).
• Credits earned via evidenced compliance; weighted scores determine ratings (e.g., Excellent ≥70%).
• Built on technical manuals, KBCNs for updates, and third-party assurance.
• **Certification modelLicensed assessors submit evidence; BRE audits and certifies.

Why Organizations Use It

• Drives operational savings (e.g., 22-33% energy reduction), asset value uplift (up to 30%), ESG alignment.
• Mitigates regulatory, financial, reputational risks; supports EU Taxonomy.
• Builds stakeholder trust via independent verification; enhances market differentiation.

Implementation Overview

• Phased: pre-assessment, design integration, construction evidence, certification, In-Use monitoring.
• Early assessor/AP appointment key; applies globally to all sizes/sectors.
• Requires training, evidence management; BRE certification valid 3 years for In-Use. (178 words)