What It Is

Digital Operational Resilience Act (DORA), formally Regulation (EU) 2022/2554, is an EU-wide regulatory framework enhancing ICT resilience for the financial sector against disruptions like cyberattacks and third-party failures. Applicable to 20 financial entity types and critical ICT providers (CTPPs), it adopts a risk-based, proportional approach harmonizing national rules.

Key Components

• **ICT Risk ManagementStrategies for identification, protection, detection, response, recovery, and learning.
• **Incident Reporting4-hour initial, 72-hour intermediate, 1-month root-cause reports for major incidents.
• **Resilience TestingAnnual vulnerability scans and triennial threat-led penetration testing (TLPT).
• **Third-Party Risk OversightContractual clauses, monitoring, ESAs supervision of CTPPs. No formal certification; compliance via management oversight and authority reporting.

Why Organizations Use It

• Mandatory compliance prevents fines up to 2% global turnover.
• Mitigates systemic risks amid 74% ransomware incidents.
• Builds trust, optimizes operations, spurs cybersecurity innovation.
• Ensures resilience in digital-dependent finance.

Implementation Overview

Gap analyses, framework development, testing programs, vendor due diligence. Targets ~22,000 EU entities; proportionality aids SMEs. Key from 2023 entry-into-force, full application January 17, 2025; involves audits, multi-year plans.

What It Is

ISO 45001:2018 is the international standard for Occupational Health and Safety Management Systems (OHSMS). It provides a framework to prevent work-related injuries and ill health, improve OH&S performance, using a risk-based, PDCA cycle approach aligned with Annex SL for integration with other ISO standards.

Key Components

• Clauses 4–10 cover context, leadership, planning, support, operation, evaluation, and improvement.
• Emphasizes hierarchy of controls, worker participation, and contractor management.
• Built on PDCA and High-Level Structure; certification via third-party audits.

Why Organizations Use It

• Reduces incidents, legal risks, and costs; enhances resilience and reputation.
• Meets stakeholder expectations; enables integrated management systems.
• Drives culture change, leadership accountability, and competitive advantage.

Implementation Overview

• Phased: gap analysis, policy/objectives, controls, audits, certification.
• Scalable for all sizes/sectors; 6-12 months typical; requires training, audits.