DORA’s Reach: How UK ICT Service Providers Are Affected

By Jamie Hayward, Cybersecurity Consultant, Razorthorn Security

The Digital Operational Resilience Act (DORA) is set to reshape the landscape of financial services in the European Union. But its impact extends beyond EU borders, particularly affecting UK-based Information and Communication Technology (ICT) service providers. Let’s explore how DORA might influence these providers and what steps they should consider taking.

The Extended Arm of DORA

While DORA is an EU regulation, its implications for UK ICT service providers are significant:

Serving EU Financial Entities – UK ICT providers serving EU financial institutions will indirectly fall under DORA’s scope. These institutions will require their service providers to comply with DORA’s stringent requirements.

Critical Third-Party Providers (CTPPs) – DORA introduces a new oversight framework for CTPPs. UK providers deemed critical to EU financial entities may face direct oversight from EU financial regulators.

Market Access – Compliance with DORA may become a de facto requirement for UK ICT providers looking to maintain or expand their EU financial sector client base.

Key Areas of Impact

Contractual Obligations – DORA sets specific requirements for contracts between financial entities and ICT providers. UK providers may need to revise their service agreements to include:

• Comprehensive description of services
• Service level agreements with precise quantitative and qualitative performance targets
• Relevant provisions on accessibility, availability, integrity, security and protection of personal data
• Reporting obligations and access rights for regulators

Audit and Access Rights – EU financial entities and their regulators will have expanded rights to access, inspect, and audit critical ICT service providers. UK providers must be prepared to accommodate these requirements.

Sub-outsourcing Controls – DORA places restrictions on sub-outsourcing of critical or important functions. UK ICT providers will need to review and potentially revise their sub-contracting practices.

Exit Strategies – The regulation mandates that contracts include clear termination rights and exit strategies. UK providers will need to develop and document comprehensive transition plans.

Incident Reporting – ICT providers will be required to report major ICT-related incidents to their financial sector clients. This may necessitate new reporting processes and capabilities.

Navigating the New Landscape

For UK ICT service providers, adapting to DORA’s requirements will be crucial. Here are some steps to consider:

Assess EU Exposure – Evaluate your current EU financial sector client base and potential growth areas to understand the extent of DORA’s impact on your business.

Gap Analysis – Conduct a thorough review of your current practices against DORA’s requirements. Identify areas needing improvement or development.

Enhance Security and Resilience – Invest in bolstering your cybersecurity measures and operational resilience. This not only aids compliance but also improves your overall service offering.

Revise Contracts and Policies – Review and update your service agreements, policies, and procedures to align with DORA’s requirements.

Develop Reporting Capabilities – Enhance your incident detection, management, and reporting capabilities to meet DORA’s stringent requirements.

Prepare for Oversight – If you’re likely to be classified as a CTPP, prepare for potential direct oversight from EU financial regulators.

Staff Training – Ensure your staff is well-versed in DORA’s requirements and your updated processes and procedures.

Opportunities Amidst Challenges

While DORA presents challenges, it also offers opportunities for UK ICT service providers:

Competitive Advantage – Early adopters of DORA-compliant practices may gain a competitive edge in the EU financial services market.

Enhanced Service Offering – The improvements made to comply with DORA can lead to a more robust, secure, and resilient service offering, benefiting all clients, not just those in the EU financial sector.

Market Expansion – Demonstrating compliance with DORA may open doors to new clients in the EU financial sector.

The Road Ahead

As the financial services ecosystem continues to evolve, the line between financial entities and their technology providers grows increasingly blurred. DORA recognises this reality, extending its reach to critical ICT providers.

For UK ICT service providers, adapting to DORA is not just about compliance—it’s about staying relevant in a changing market. By embracing DORA’s principles of digital operational resilience, UK providers can position themselves as trusted partners in the global financial services sector.

The journey towards DORA compliance may be challenging, but it offers a clear path to enhanced resilience, improved service quality, and potentially, new business opportunities. For UK ICT service providers, the time to start preparing is now.

For any assistance you might need with DORA compliance, get in touch – we’d be happy to help.