Digital Operational Resilience Act (DORA) Compliance: Key Regulatory Updates

The key changes to DORA regarding TLPT relate to testing criteria, the conducting of testing and the requirements for testers.

• Testing criteria: The ESAs revised and updated the selection criteria for financial entities. The criteria now includes impact-related factors, potential financial stability concerns, ICT risk profiles and levels of ICT maturity. They also increased the threshold for payment institutions to 150 billion euro.
• Conducting of testing: The report clarifies aspects of pooled testing and joint TLPT and when purple team testing should take place.
• Requirements for testers: The ESAs reviewed and eased requirements for testers, introducing flexibility by broadening  tester experience criteria from experience in TLPT to experience in penetration testing and red teaming.For internal testers, they have reduced criteria about the required tenure length for holding a role within the financial entity from two years to one. The second batch of DORA mandates also contain a provision making it possible for financial entities to choose TLPT providers that do not meet all requirements in the case of exceptional circumstances. 

The changes introduced to the ICT-related incident-reporting regime for financial entities relate to the scope of incidents that require reporting, the timelines for reporting major incidents and the data points for major incident reporting. 

• Scope of incidents to be reported: The changes reduce the scope for mandatory weekend and bank holiday reporting by excusing smaller entities from reporting the initial notification in relation to incidents. Not all financial entities are obliged to maintain a 24/7 incident reporting support function. The updates also introduce aggregated incident reporting for instances where a single incident has impacted multiple financial entities.
• Timelines for major incident reporting: The updates extend reporting timelines for financial entities: rather than begin from the moment when the incident is classified, the 24 hour / 72 hour reporting windows will begin when the prior notification or report is submitted. Regarding weekend and bank holiday reporting, the previous time limit of one hour for submitting notifications and reports has been extended, and financial entities now have until noon on  the first working day to do so.
• Data points for major incident reporting: To reduce the workload for financial entities dealing with an incident, the ESAs;
  • Reduced the number of reporting fields in the reporting template from 84 to 59,
  • Reduced the number of reporting fields in the initial notification from 17 to 10, and
  • Reduced the number of mandatory fields required across all three reports (initial, intermediate and final). For example, the initial notification was reduced from nine to seven. Overall across the three reports, the total number of mandatory fields has gone from 37 to 28. 

The final report introduces two major changes for the estimation of costs and losses. These changes will allow for additional flexibility and seek to further reduce the reporting burden on financial entities.

Financial entities can now choose which reference year they want to use, either the accounting year or the calendar year, and they are no longer required to include and report the net costs and losses.