Digital operational resilience starts with visibility and control

The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, establishes requirements for financial entities to manage ICT risks and strengthen their ability to withstand, respond to and recover from ICT-related disruptions.

DORA addresses ICT risk management, ICT-related incident handling and reporting, digital operational resilience testing, ICT third-party risk management and information sharing.

Cetbix GRC helps organisations bring these activities into a structured governance, risk and compliance environment. Connect regulatory requirements with risks, controls, owners, evidence, findings and corrective actions to create a more traceable approach to digital operational resilience.

1. ICT risk management

DORA requires financial entities to establish and maintain a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system.

Cetbix GRC can provide a structured environment to manage the governance and oversight activities associated with ICT risk.

• Maintain a structured ICT risk register.
• Identify risks affecting business functions and supporting technology.
• Connect risks to relevant controls and mitigation measures.
• Assign risk owners and control responsibilities.
• Document assessments, decisions and supporting evidence.
• Track treatment plans, findings and outstanding actions.
• Monitor risk status and management reporting.

2. ICT-related incident management and reporting

Financial entities need processes to identify, manage, classify and report ICT-related incidents in line with DORA and the applicable technical standards.

Cetbix GRC can support the governance and oversight of incident-related compliance activities by connecting incident records, risks, controls, evidence and remediation.

• Document ICT-related incidents and associated business impact.
• Link incidents to affected services, assets, risks and dependencies.
• Record investigation findings and root-cause analysis.
• Assign responsibilities for response and follow-up.
• Track corrective and preventive actions.
• Maintain supporting documentation and an audit trail.

Important: Regulatory incident classification, notification deadlines and reporting submissions must follow the applicable DORA requirements and competent authority procedures. A GRC record should not be treated as an automatic regulatory submission.

3. Digital operational resilience testing

DORA requires financial entities to maintain a testing programme appropriate to their size, business and risk profile. Testing helps assess the effectiveness of preventive, detection, response and recovery capabilities.

Cetbix GRC can help organise the governance and follow-up of resilience testing activities.

• Maintain a structured overview of planned and completed tests.
• Document test scope, objectives and responsible stakeholders.
• Record test findings, vulnerabilities and observations.
• Assign remediation actions and target dates.
• Link findings to relevant ICT risks and controls.
• Monitor remediation progress and outstanding issues.
• Retain supporting reports and evidence.

Depending on the entity and applicable requirements, testing activities may include vulnerability assessments, security testing, scenario-based testing, business continuity testing and threat-led penetration testing (TLPT).

4. ICT third-party risk management

Financial entities remain responsible for meeting their DORA obligations when they use external ICT service providers. They need to understand their dependencies, assess associated risks and manage contractual arrangements appropriately.

Cetbix GRC can support a structured third-party risk management process.

• Maintain an inventory of ICT service providers.
• Identify services supporting critical or important functions.
• Assess supplier security, resilience and operational risks.
• Connect suppliers to business services, assets and risk records.
• Document contractual arrangements and relevant obligations.
• Record supplier assessments, assurance reports and review evidence.
• Track issues, remediation plans and periodic reviews.