In a previous alert, Too Important To Fail? Further Light on When EU and Non-EU Technology Providers Will Become Subject To DORA, we discussed the EU Digital Operational Resilience Act (DORA). We have also set up a microsite to address DORA and the similar regime in the UK: Financial Regulations for Critical Third-Party Technology Providers in the EU and UK.
DORA came into force on 16 January 2023, and will apply starting on 17 January 2025. In addition to the provisions of DORA that apply to EU financial entities, such as banks, broker-dealers, and insurers, DORA will also apply to critical third-party providers (CTPPs) that provide services such as information and communication technology to EU financial entities. As we have noted before, DORA can apply to non-EU CTPPs, including those in the US and UK, that provide services to EU financial entities.
On 18 September 2023, the EU Commission published a communication — Communication from the Commission – Commission Guidelines on the application of Article 4 (1) and (2) of Directive (EU) 2022/2555 (NIS 2 Directive) or "the Communication" — setting out guidelines on the application of provisions in EU in the Network and Information Security Directive (Publications Office [NIS 2]) to EU financial entities that are within the scope of DORA.
We noted the developments connected with NIS 2 in our recent
update EU/UK Privacy & Cybersecurity News Roundup
– Week of June 26, 2023. NIS 2 came into force on 16
January 2023. NIS 2 aims to modernise the existing EU-wide legal
framework (NIS 1) on cybersecurity by extending the scope of
cybersecurity rules to new sectors and entities and strengthening
the resilience and incident-response capacities of public and
private entities. In particular, NIS 2 recognises that financial
institutions must ensure the continuous availability of their
networks and information systems, because any disruption can have
serious consequences for their clients and the wider financial
system. EU member states have until 17 October 2024, to transpose
NIS 2 requirements into national law, with these taking effect on
18 October 2024.
The Communication seeks to clarify the application of provisions on
cybersecurity risk-management measures or incident-reporting
requirements for financial entities covered by both NIS 2 and
DORA.
The Communication makes it clear that that the following DORA provisions, rather than the similar NIS 2 provisions, will apply to financial entities within the scope of both DORA and NIS 2:
- Information and communication technology risk management — DORA, Article 6
- Management of incidents related to information and communication technology (ICT), especially major ICT-related incident reporting — DORA, Article 17
- Digital operational-resilience testing — DORA, Article 24
- Information-sharing arrangements — DORA, Article 25
- ICT third-party risk — DORA, Article 28
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.