I hope you can all hear me see me and see my presentation.

So we are going to have a this afternoon we're going to go through talk about DORA compliance for ICT providers, what you need to do, what you need to know, some of the key things you need to think about, need to understand and what DORA is, how it's affecting things, all these all these wonderfully interesting topics.

So we will start off in a couple of minutes.

I'm going to ask you to be a bit interactive and respond to a few questions because it's going to be useful for me to to understand who I've got on the call etc.

So first of all who am I?

Very good question.

So my name is Andrew Paterson.

I'm the head of GRC consultancy for IT Governance Europe and I've been working in GRC for probably it's near the 30 years and 20 years anyway, probably quite a lot closer to 30 years and 20 years.

I'm a certified ISACA trainer.

I have a master's in information systems management which was quite a long time ago but we weren't just looking at advocacies we were looking at proper IT even then.

I'm the SME within the group in things like NIS, NIS2 which as we may know is a directive, things like cybersecurity framework 27001, SIS 18, ECC which is a Saudi Arabian standard and DORA.

I've worked in lots and lots of sectors over the years.

That's just a few examples of some of the areas I've been helping people affected with DORA for around the last 12 months, helping them to get ready for the deadline which we'll talk about when that is a bit later.

I'm also the author of a DORA, a guide to the DU Digital Operationals Resilience Act and it's very much that book is a practical guide about what you need to do about it.

It's not particularly legalistic, it's about how you develop and implement an ISMS that will meet the requirements of DORA.

So just a couple of little slides here about who we are, IT Governance.

You've obviously heard of us before because you're sitting on this webinar but we've been in the industry for over 20 years, 12,000 clients, we work globally.

The big area of people more familiar with us is in 27001 and GDPR and everything but when you start looking at DORA, 27001 is an incredibly useful vehicle for helping you to deal with what is required out of DORA.

It talks about the same sort of things, there's a different emphasis in some areas but we'll go through that.

So that's who we are, we've worked with all of these different people, we've got 1300 projects in ISO, we've got our cyber essentials and we've got our governance and risk tool called cyber comply which has got almost two and a half thousand people customers using it globally.

You can see all the information on there, just a little thing on the slides, you will be given access to a slide pack because some of the slides have got quite a lot of detail on them and probably more useful if you come back and read them later because I will not be reading every single line on every slide, I'll be talking around them.

So that's that sort of thing.

If you're familiar with Net Promoter Scores, that's our things like that over the last whatever you've had to do.

So this is where we're going to ask you to do a little bit of interaction and voting and it'll give me a little bit idea about who's on the call and maybe I will make sure I mention a few things which are specific to those requirements.

So the first question we'd like you to respond to is this one, what is your role in the DORA compliance decision making process?

So you've got the choice of this, I am a key decision maker, I influence decisions but I'm not the final decision maker, I am gathering information for my team.

So you should get the option there to respond to that question.

So I'll give you a little bit of time to do that.

It's like waiting for the the results of Eurovision.

So a few more moments.

Okay then, so we've got a few decision makers on there and then it's split between people influencing the decision maker and I'm gathering for the team.

So it's pretty much your most most of you are finding out more information etc and all that sort of stuff.

That's brilliant, thank you very much.

Okay the next question, what is your timeline for implementing DORA?

We might have a different response at the end of the webinar on this one.

Within the next three months, in four to six months, beyond six months or no timeline set?

So if you can respond to the questions there.

Okay we'll wait for a couple of more responses on that.

Okay then, so most of you are talking about probably something in beyond six months.

Okay if you speak quicker than that.

Okay thank you for that.

Next question, what type of support does your organization need most for DORA compliance?

So compliance software solutions, consultancy and advisory services, training and education, and so on and so forth.

Okay, so what type of support do you need most for DORA?

So if you could give us your response on that.

A few more seconds.

Okay, so on this we've got a pretty much a split, we could be almost across the three areas on that.

So thank you very much for that.

And now the last question, has your organization allocated a budget for DORA compliance solutions?

Yes, we have a dedicated budget.

Budget is under consideration.

No budget allocated yet.

Just a few more moments and then we'll close that poll.

Okay then, so mainly no budget allocated yet and a few people have got a budget under consideration, but actually you need to be able to show that you have budgets for cyber security etc.

So we'll talk about that.

So a couple of things, you will see that you've got the ability to ask questions.

If you put questions in there, we'll have some time at the end of the webinar for me to respond to those questions.

So if anything comes to mind as we're going through, please put them up.

Also, just to remind you, you do actually get a CPD point for this, so you will get a certificate for that.

It's always useful for your professional development, do a few webinars and you can make inroads into the amount you need to get through the year.

So we're going to go through several of the topics and again some of the slides are quite detailed and you'll have access to them.

You may be going to read those later.

So it's all about trying to explain to you what DORA is and how we're particularly looking at it, what it means for third party suppliers.

So we'll go through all these different things and we will talk to them some in more detail than others.

So what's DORA got to do with ICT third party suppliers?

Now DORA is the Digital Operational Resilience Act.

It's a regulation.

So to understand that, that means that it without need to go through parliaments, it's not a directive.

So it doesn't have to go through 27 parliaments and be approved.

And it's very specific in what it says needs to be covered by the regulation.

And they talk about financial entities and they describe what a financial entity is.

It's anything which is regulated, okay.

Few exceptions etc and all that, but basically anything.

And then on the last line, it goes ICT third party suppliers.

So if you supply into a financial entity, which is in the European Union, you're going to be covered by DORA, okay.

Even if you're not in the European Union, okay.

So if you're an ICT third party supplier and you're supplying into a financial entity in the European Union, you're covered by it.

If you're a large organization, which is supplying services to a part of your organization, which is in the European Union, okay, you have to comply with the requirements of DORA.

So if you're sitting there thinking, all right, so who's that?

Does that affect me?

This is not a definitive list, but this is because it doesn't actually say in there, what is an ICT third party supplier, but it builds up and gives you some sort of ideas on this.

So it's people who are impacted, people who are delivering services.

And it is specifically where I'll talk about on the next slide in more detail is that supporting critical important functions, right, or services that the financial entity provides.

So there's a quick list there of some of the things.

So if you actually look at it, it's very broad on what they mean by an ICT third party supplier.

So, you know, GIC risk management providers, collaborative tool providers, desktop service providers, IT service providers, SOC service providers.

So if you're working with a financial entity and you're providing any ICT services, you're probably going to be covered by the requirements of DORA.

And what do I mean by covered by the requirements of DORA?

The next slide gives you a bit of a feel for how the structure works and why it's important to think about where you are.

So this is a nice little, nice and colourful pyramid.

And it just gives you a feel.

So at the top, we've got the EU Parliament, we've got the European Central Bank, we've got the supervisory authorities, the member states, they need to be enforcing this and making sure this happens.

And then they have things in their countries called national competent authorities.

These are the guys who are going to make sure that financial entities are doing what they need to do with DORA.

And then you have the financial entity.

And the financial entity needs to make sure that you're doing what they need to ensure that they are going to comply with DORA.

Okay.

So much so that DORA specifies certain things that need to be in the contractual requirements while dealing with third parties.

And when you get into that particular, some of And if you think about it, if you've got third parties working for you who are providing your services to you, which is central to the services that you're providing a financial entity, you're going to have to manage your third party supply chain as well.

And this is one of the very key things.

It's about improving resilience and operational resilience, not just within the financial entity, but within that supply chain, because there is an understanding of weakness.

And that more comes on to what we talk on the next section.

So why does DORA exist and what is it?

Okay.

So this slide is the sort of slide, but when you've got it back and you can zoom it up, but it gives you the, you know, it's about a risk, systemic risk across financial services in the European Union.

We all know that with, I mean, I'm old enough to remember when, you know, you had to be physically on a, in front of a machine with a cable coming out the back of it in the same building to get access to things.

And we don't work in that world anymore.

We've got 24 seven access.

Everything is interrelated.

So there's so much interconnectivity within all sectors and within financial services that if you get a problem somewhere, it's multiple countries.

So it's about building up and understanding this, where the resilience is, because, you know, it's so important that these functions from financial services operate.

That's basically how economies don't work.

Okay.

And if you're an ICT third-party supplier in that chain, it's very important for you meeting those requirements.

So what was the key things and what they were talking about when they were developing this?

DOOR sets out a harmonized approach to digital operational resilience across the EU's financial sector.

So everybody has to do it.

Okay.

Level playing field.

It's not like somebody in one legislation doesn't have to do the same.

It's why it's a regulation and not a directive, because it doesn't need to go through national law or national parliaments.

This is what people need to do.

And it's been around since 22.

Okay.

It's not just like appeared recently.

Okay.

It's been around since December 2022.

And it harmonizes, removes, you know, certain directives, etc.

As it's a regulation, it supersedes the requirements of the NIST directive and NIST 2.

And it sets out certain things expected by financial entities.

And this will be new for many service providers.

Okay.

So you may be doing some of these things, but this is not a tick box.

Okay.

This is about operational resilience.

So this is about financial entities being able to provide their services when bad things are happening to them.

Okay.

I describe it in one simple way, and we'll go into more detail of this, is if you think about incident management, business continuity, and disaster recovery, which you all probably do, but the volume's turned up on it, it's taking it to the next level.

Okay.

And it's definitely not tick box.

You have to do things.

And they're very specific in what they require.

So the regulation covers certain things.

So ICT risk management, everything is driven by risk.

What are the risks to the organization?

What are we doing about this?

And this is any type of organization.

It's very specific in what they need to do about incident reporting.

So the financial entity has to report about incidents to the competent authorities if they're happening.

You as an ICT third party service provider need to make sure that you are sharing with your financial entity, the correct information in that regard as well.

What testing have you got in place?

You know, so it is, you might have some nice plans, but if they don't test it, they don't exist.

That's a nice sack of view of the world.

And that's a good view to have.

Testing is so important.

And when we mean testing, it doesn't mean, you know, you go and pull the plug out the back of things and see what happens.

But if you've got DR site, have you tested it all over?

Are you doing tabletop exercises?

You know, are you doing this?

There is again, in there about information sharing.

It's only a small part of it about how organizations can share information.

It's particularly in there, but if they want to share information about threats and intelligence, they're not falling foul of competition laws and all that sort of stuff.

But one of the big things in there is how they manage their third parties.