DORA - What Matters Now for Your Business Resilience

Chief Risk Officers (CROs) will need to integrate and quantify a company's ICT risks in a holistic manner, and ensure that they are part of the overall risk evaluation alongside other existing risks. CROs will also need to evaluate internal and external risks, such as reputational and legal risks, in case a major cyber attack or operational incident takes place.

Chief Operating Officers (COOs) will need to review existing processes and determine where the opportunities to scale operations are and review existing ICT outsourcing chains with the view of aligning operational resilience with efficiency and long-term scalability.

Chief Information Officers (CIOs) play a key role in carrying out the initial transversal risk assessment and evaluation at the start of the DORA compliance journey. CIOs will also need to determine how their firms’ ICT landscapes can be simplified while simultaneously increasing operational resilience, and how more resilient solutions and a resilient-by-design approach can be achieved. Ultimately, the CIO is the focal point between the firm’s ICT department and the C-Suite management, and DORA presents an opportunity to question the current ICT situation, enhance corporate ICT governance, and redesign ICT architecture and service levels as well as provider management.  

Chief Information Security Officers (CISOs) are responsible for identifying and assessing all cybersecurity-specific risks, informing the firm’s leadership of such risks, and preparing plans to deal with the threats. The CISOs are also required to independently assess the company-wide risk treatment plan which the CIO prepares, as well as contributing to the development of the risk mitigation strategy for the firm and ensuring digital operational resilience by performing regulator controls and tests. Lastly, CISOs must inform the firm’s leadership about both attacks and major vulnerabilities, and educate them on ICT and security topics via informative meetings and workshops. In return, the leadership should contribute to the development of the target operating model and ensure that the firm’s cybersecurity apparatus is provided with all the resources necessary.