DORA
EU regulation for digital operational resilience in financial sector
ISO 28000
International standard for supply chain security management systems.
Quick Verdict
DORA mandates digital resilience for EU finance against ICT risks via testing and reporting, while ISO 28000 offers voluntary supply chain security frameworks globally. Firms adopt DORA for regulatory compliance; ISO 28000 for resilience, certification, and market advantage.
DORA
Regulation (EU) 2022/2554
ISO 28000
ISO 28000:2022 Security management systems Requirements
Key Features
- Risk-based supply chain security assessment and treatment
- PDCA cycle for continual SMS improvement
- Supplier and third-party security governance
- Integration with ISO 22301 and 27001 standards
- Incident response and recovery planning
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
DORA Details
What It Is
Digital Operational Resilience Act (DORA), formally Regulation (EU) 2022/2554, is a transformative EU regulation. It mandates digital operational resilience for the financial sector against ICT disruptions like cyberattacks and third-party failures. Applicable to 20 financial entity types and critical ICT third-party providers (CTPPs) across 27 member states, it uses a risk-based, proportional approach focusing on proactive strategies over reactive measures.
Key Components
Core pillars include ICT risk management frameworks for identifying and mitigating risks; standardized incident reporting with 4-hour notifications; resilience testing via annual scans and triennial threat-led penetration testing (TLPT); and third-party oversight with due diligence and ESAs supervision of CTPPs. Proportionality tailors requirements to entity size and risk profile, with no formal certification but strict compliance enforcement.
Why Organizations Use It
Financial entities comply to meet legal obligations ahead of January 2025 deadline, avoiding fines up to 2% of global turnover. It mitigates systemic cyber risks (74% perceive as top threat), enhances resilience post-incidents like CrowdStrike outage, builds stakeholder trust, and drives cybersecurity innovation amid €10-15B EU spend.
Implementation Overview
Involves gap analyses against RTS/ITS, framework development, testing programs, and vendor monitoring. Targets ~22,000 entities; larger firms leverage existing setups, SMEs face challenges. Ongoing ESAs oversight with Batch 1/2 standards guides phased rollout by 2025.
ISO 28000 Details
What It Is
ISO 28000:2022 is an international management system standard specifying requirements for establishing, implementing, maintaining, and improving a security management system (SMS) focused on supply chain security and resilience. It adopts a risk-based approach using the PDCA cycle, aligned with ISO High Level Structure.
Key Components
- Clauses cover context, leadership, planning, support, operation, performance evaluation, and improvement.
- Emphasizes risk assessment, security strategies, incident response, supplier controls, and continual improvement.
- Built on ISO 31000 risk principles and integrates with ISO 22301, ISO 27001.
- Optional third-party certification via accredited bodies per ISO 28003.
Why Organizations Use It
- Mitigates supply chain risks like theft, sabotage, disruptions.
- Meets contractual, regulatory, trade facilitation needs.
- Reduces incidents, insurance costs; enhances market access, reputation.
- Builds stakeholder trust through auditable governance.
Implementation Overview
- Phased: scoping, gap analysis, risk assessment, controls deployment, audits, certification.
- Scalable for all sizes/industries (logistics, manufacturing, pharma).
- Global applicability; involves training, supplier engagement, KPIs monitoring.
Key Differences
| Aspect | DORA | ISO 28000 |
|---|---|---|
| Scope | Digital operational resilience in finance | Supply chain security management systems |
| Industry | EU financial entities and ICT providers | All industries worldwide, supply chain focused |
| Nature | Mandatory EU regulation with enforcement | Voluntary international certification standard |
| Testing | Annual basic tests, triennial TLPT | Internal audits, management reviews, certification audits |
| Penalties | Up to 2% global turnover fines | Loss of certification, no legal penalties |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about DORA and ISO 28000
DORA FAQ
ISO 28000 FAQ
You Might also be Interested in These Articles...
NIST 800-53 Private Sector ROI Reality Check: Isolating Control Family Impacts on 2024 Breach Costs
Discover NIST 800-53 ROI in private sector: control families like RA, SI, SR reduce median breach costs from $100K to under $50K. Get benchmarks to prioritize i
The Reasons Why NIS2 is Fundamental for Cyber Resilience in Europe
Uncover why NIS2 transcends compliance burdens, delivering real cyber resilience value through enforced measurements and activities. Explore insights via our pa
Your Guide to Implementing PCI DSS in Your Organization
Step-by-step guide to implementing PCI DSS in your organization. Achieve compliance, protect cardholder data, and reduce risks. Start securing payments today!
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
NERC CIP vs ISO 27018
Discover NERC CIP vs ISO 27018: Grid cyber-reliability standards clash with cloud PII privacy controls. Uncover synergies, gaps & compliance strategies for BES security pros. Dive in!
ISO 50001 vs IATF 16949
Compare ISO 50001 vs IATF 16949: Energy mastery (EnMS, PDCA, continual improvement) meets automotive QMS excellence (core tools, defect prevention). Align, integrate, excel. Discover now!
ISO/IEC 42001:2023 vs ISO 56002
Uncover ISO/IEC 42001:2023 vs ISO 56002: AI risk governance (bias, ethics, PDCA) vs innovation systems (portfolio, value). Align for compliance & growth—read now!