Preparing for DORA

In today’s highly digitized world, information communication technology (“ICT”) supports systems used for many everyday activities in areas such as banking and investment. The aim of DORA is to harmonise and improve the regulation of digital operational resilience for the financial sector. This should assist the sector to better withstand ICT-related disruptions and threats. To achieve this aim, DORA introduces uniform requirements for the security of ICT systems that support the business processes of entities that fall within its scope.

Scope

DORA applies to a broad range of financial entities including investment firms, credit institutions, payment institutions and, in the pensions context, institutions for occupational retirement provision (“IORPs”) (in Ireland more commonly called pension schemes). DORA also applies to certain in-scope third party service providers. Accountability for compliance with DORA is clearly established at senior management level, and, for pension schemes, with the scheme trustees. Member States are to provide for appropriate penalties (including potential criminal penalties) and remedial measures to be applied to breaches of DORA. In light of the broad scope of DORA, as well as the extensive obligations it imposes on in-scope entities, DORA includes a “proportionality principle”. IORPs with less than 15 members are exempt from the application of DORA, whereas small-to-medium IORPs of up to 100 members will be subject to a “simplified” risk management framework under Article 16 of DORA, described further below. IORPs with over 100 members will be subject to the full regulation of DORA, which is set out in Articles 1 to 15.

In addition, DORA outlines that the national supervision of the implementation of DORA by in-scope entities, should take into account their “size and overall risk profile, and the nature, scale and complexity of their services”. Of particular relevance to pension schemes, DORA outlines that competent authorities should maintain a vigilant but proportionate approach with respect to IORPs which outsource a significant part of their core business such as asset management, actuarial calculations, accounting and data management to service providers.

Full Regulation

There are five pillars to DORA, which focus on the key measures in-scope entities are expected to put in place during the implementation period, as outlined below.

Risk Management

In-scope entities are required, under Article 5, to have internal governance and control frameworks in place which ensure that all ICT risks are managed effectively and prudently. These frameworks should enable entities to achieve a high level of digital operational resilience.

Incident Reporting

Significant ICT related breaches or incidents are to be reported (to the Pensions Authority in the case of pension schemes) and cyber threats are to be recorded. In-scope entities are expected to assess the impact of incidents and analyse their root causes. A system will also be put in place to allow voluntary reporting of cyber threats.

Resilience Testing

Robust resilience testing on ICT security measures is required and such tests must be carried out at least annually. Certain entities will also need to conduct “threat-led penetration testing” using live production systems. This approach is intended to allow entities to detect and mitigate against vulnerabilities and breaches.

Third-party Risk Management

Third party ICT service providers (defined as digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis) must be managed, and risk assessment of such service providers must be carried out. DORA sets out multiple contractual terms that must be included in ICT outsourcing contracts.

Intelligence Sharing

DORA paves the way for sharing of information and intelligence regarding cyber threats. The legislation envisages a “trusted community of financial entities” through membership arrangements, to facilitate the sharing of information between financial institutions.

Simplified Regulation

In line with the proportionality principle, certain small-to-medium entities (“SMEs”) are subject to lighter requirements under DORA due to their size and effect on the market. This category includes IORPs with less than 100 members in total.

Amongst other requirements, Article 16 of DORA requires that SMEs should put in place and maintain a “sound and documented” ICT risk management framework. This should be aimed at a quick, efficient, and comprehensive management of ICT risk. Both a business continuity plan and recovery measures (such as back-up and restore) should be developed. SMEs are also expected to identify key dependencies on third-party service providers.

The plans and measures to be put in place, as well as the effectiveness of frameworks and systems required to be put in place must be regularly tested. Following such tests, SMEs should implement operational conclusions and post-incident analysis.

Oversight of Critical Third-Party Service Providers

DORA introduces a new oversight framework for third-party ICT service providers that are considered “critical.” It remains to be seen whether pensions administrators will be designated as critical under DORA. The European Supervisory Authorities (“ESAs”), through a joint committee and upon recommendation from an oversight forum, will designate third party service providers as critical based on an assessment which will take into account a number of factors set out in Article 31 of the DORA legislation.

Regulatory Technical Standards

The ESAs are in the process of releasing batches of Regulatory Technical Standards (“RTS”) and Implementing Technical Standards (“ITS”) to assist applicable financial institutions to understand what is required to achieve compliance with DORA. The first batch of draft RTS and ITS was released in June 2023 (these are to be submitted to the European Commission by January 2024 for adoption). The second batch is to be published by July 2024.

Recommended Next Steps for Pension Schemes

There is no doubt other than DORA will place additional administrative and cost burdens on IORPs to which it applies.

While many of the risk management provisions outlined in DORA will be familiar to entities operating in the banking and insurance sectors, this does not apply equally to pension schemes operating in Ireland. Notwithstanding the risk management framework which will have previously been put in place by pension scheme trustees under IORP II, DORA will require trustees to develop a deeper understanding of, and engagement with, the ICT infrastructure of their pension schemes.

Due to the relatively tight time period before compliance is required, schemes may wish at this point to begin examining processes and policies in place and conducting an assessment into any gaps between requirements under DORA and existing ICT security frameworks. It will also be important for schemes to review any contractual documentation with third party service providers as these agreements may be impacted by (and require amendment due to) the requirements under DORA.