Name: DORA compliance for ICT Providers - What Do You Need to Do?
Uploaded: 2024-07-27T09:43:21.000Z
Duration: 58 min 31 s
Description: Thousands of YouTube videos with English-Chinese subtitles! Now you can learn to understand native speakers, expand your vocabulary, and improve your pronunciation...

I hope you can all hear me see me and see my presentation.

So we are going to have a this afternoon we're going to go through talk about DORA compliance for ICT providers, what you need to do, what you need to know, some of the key things you need to think about, need to understand and what DORA is, how it's affecting things, all these all these wonderfully interesting topics.

So we will start off in a couple of minutes.

I'm going to ask you to be a bit interactive and respond to a few questions because it's going to be useful for me to to understand who I've got on the call etc.

I'm the head of GRC consultancy for IT Governance Europe and I've been working in GRC for probably it's near the 30 years and 20 years anyway, probably quite a lot closer to 30 years and 20 years.

I have a master's in information systems management which was quite a long time ago but we weren't just looking at advocacies we were looking at proper IT even then.

I'm the SME within the group in things like NIS, NIS2 which as we may know is a directive, things like cybersecurity framework 27001, SIS 18, ECC which is a Saudi Arabian standard and DORA.

I've worked in lots and lots of sectors over the years.

That's just a few examples of some of the areas I've been helping people affected with DORA for around the last 12 months, helping them to get ready for the deadline which we'll talk about when that is a bit later.

I'm also the author of a DORA, a guide to the DU Digital Operationals Resilience Act and it's very much that book is a practical guide about what you need to do about it.

It's not particularly legalistic, it's about how you develop and implement an ISMS that will meet the requirements of DORA.

So just a couple of little slides here about who we are, IT Governance.

You've obviously heard of us before because you're sitting on this webinar but we've been in the industry for over 20 years, 12,000 clients, we work globally.

The big area of people more familiar with us is in 27001 and GDPR and everything but when you start looking at DORA, 27001 is an incredibly useful vehicle for helping you to deal with what is required out of DORA.

It talks about the same sort of things, there's a different emphasis in some areas but we'll go through that.

So that's who we are, we've worked with all of these different people, we've got 1300 projects in ISO, we've got our cyber essentials and we've got our governance and risk tool called cyber comply which has got almost two and a half thousand people customers using it globally.

You can see all the information on there, just a little thing on the slides, you will be given access to a slide pack because some of the slides have got quite a lot of detail on them and probably more useful if you come back and read them later because I will not be reading every single line on every slide, I'll be talking around them.

If you're familiar with Net Promoter Scores, that's our things like that over the last whatever you've had to do.

So this is where we're going to ask you to do a little bit of interaction and voting and it'll give me a little bit idea about who's on the call and maybe I will make sure I mention a few things which are specific to those requirements.

So the first question we'd like you to respond to is this one, what is your role in the DORA compliance decision making process?

So you've got the choice of this, I am a key decision maker, I influence decisions but I'm not the final decision maker, I am gathering information for my team.

So you should get the option there to respond to that question.

So I'll give you a little bit of time to do that.

It's like waiting for the the results of Eurovision.

Okay then, so we've got a few decision makers on there and then it's split between people influencing the decision maker and I'm gathering for the team.

So it's pretty much your most most of you are finding out more information etc and all that sort of stuff.

Okay the next question, what is your timeline for implementing DORA?

We might have a different response at the end of the webinar on this one.

Within the next three months, in four to six months, beyond six months or no timeline set?

So if you can respond to the questions there.

Okay we'll wait for a couple of more responses on that.

Okay then, so most of you are talking about probably something in beyond six months.

Next question, what type of support does your organization need most for DORA compliance?

So compliance software solutions, consultancy and advisory services, training and education, and so on and so forth.

Okay, so what type of support do you need most for DORA?

So if you could give us your response on that.

Okay, so on this we've got a pretty much a split, we could be almost across the three areas on that.

And now the last question, has your organization allocated a budget for DORA compliance solutions?

Just a few more moments and then we'll close that poll.

Okay then, so mainly no budget allocated yet and a few people have got a budget under consideration, but actually you need to be able to show that you have budgets for cyber security etc.

So a couple of things, you will see that you've got the ability to ask questions.

If you put questions in there, we'll have some time at the end of the webinar for me to respond to those questions.

So if anything comes to mind as we're going through, please put them up.

Also, just to remind you, you do actually get a CPD point for this, so you will get a certificate for that.

It's always useful for your professional development, do a few webinars and you can make inroads into the amount you need to get through the year.

So we're going to go through several of the topics and again some of the slides are quite detailed and you'll have access to them.

So it's all about trying to explain to you what DORA is and how we're particularly looking at it, what it means for third party suppliers.

So we'll go through all these different things and we will talk to them some in more detail than others.

So what's DORA got to do with ICT third party suppliers?

Now DORA is the Digital Operational Resilience Act.

So to understand that, that means that it without need to go through parliaments, it's not a directive.

So it doesn't have to go through 27 parliaments and be approved.

And it's very specific in what it says needs to be covered by the regulation.

And they talk about financial entities and they describe what a financial entity is.

Few exceptions etc and all that, but basically anything.

And then on the last line, it goes ICT third party suppliers.

So if you supply into a financial entity, which is in the European Union, you're going to be covered by DORA, okay.

Even if you're not in the European Union, okay.

So if you're an ICT third party supplier and you're supplying into a financial entity in the European Union, you're covered by it.

If you're a large organization, which is supplying services to a part of your organization, which is in the European Union, okay, you have to comply with the requirements of DORA.

So if you're sitting there thinking, all right, so who's that?

This is not a definitive list, but this is because it doesn't actually say in there, what is an ICT third party supplier, but it builds up and gives you some sort of ideas on this.

So it's people who are impacted, people who are delivering services.

And it is specifically where I'll talk about on the next slide in more detail is that supporting critical important functions, right, or services that the financial entity provides.

So there's a quick list there of some of the things.

So if you actually look at it, it's very broad on what they mean by an ICT third party supplier.

So, you know, GIC risk management providers, collaborative tool providers, desktop service providers, IT service providers, SOC service providers.

So if you're working with a financial entity and you're providing any ICT services, you're probably going to be covered by the requirements of DORA.

And what do I mean by covered by the requirements of DORA?

The next slide gives you a bit of a feel for how the structure works and why it's important to think about where you are.

So this is a nice little, nice and colourful pyramid.

So at the top, we've got the EU Parliament, we've got the European Central Bank, we've got the supervisory authorities, the member states, they need to be enforcing this and making sure this happens.

And then they have things in their countries called national competent authorities.

These are the guys who are going to make sure that financial entities are doing what they need to do with DORA.

And the financial entity needs to make sure that you're doing what they need to ensure that they are going to comply with DORA.

So much so that DORA specifies certain things that need to be in the contractual requirements while dealing with third parties.

And when you get into that particular, some of And if you think about it, if you've got third parties working for you who are providing your services to you, which is central to the services that you're providing a financial entity, you're going to have to manage your third party supply chain as well.