How does DORA impact UK entities: Key implications to consider

The Digital Operations Resilience Act (DORA) is a new regulation aimed at improving the cybersecurity and operational stability of the EU's financial sector, especially regarding risks related to information and communications technology (ICT). It applies to organizations in the financial industry, requiring them to reassess and adapt their security posture to DORA’s stringent requirements.

‍

Given the complex relationship between the EU and the UK, many UK-based organizations seek a broader understanding of the regulation's scope, especially if they serve EU-based businesses or clients. In this guide, we’ll clarify DORA’s implications for UK entities, helping you understand who needs to comply and how to do it effectively.

‍

Before exploring the specifics, let’s first review some key facts regarding DORA.

‍

A quick overview of DORA

DORA is a mandatory EU regulation offering a robust risk management framework designed to strengthen the cybersecurity and resilience of EU financial entities, with a particular focus on ICT-related risks. Its goal is to create a more secure and transparent environment for ICT third-party service providers and organizations in the financial sector, such as:

• Banks
• Investment firms
• Insurance companies
• Credit institutions
• Payment and electronic money institutions

‍

The regulation was drafted in 2020 and came into effect on January 16, 2023. Organizations have been expected to achieve full compliance by January 17, 2025, allowing for a 24-month transition period. As of January 2025, European Supervisory Authorities (ESAs) have begun their oversight activities to track compliance.

‍

DORA is specifically applicable to financial entities in the EU, but its effective scope is broader and encompasses international organizations—including UK-based companies that provide services within the EU financial sector.

‍

{{cta_withimage22="/cta-modules"}}

‍

Are UK entities impacted by DORA?

DORA directly impacts any UK entity in the finance sector that operates in the EU. Besides financial entities with a customer base in EU countries, the regulation also applies to ICT third-party service providers (ICT TPSPs) that work with the impacted financial organizations. Examples of such TPSPs include:

• Cloud providers
• Cybersecurity firms
• IT consulting companies

‍

So, if your UK-based organization is a TPSP to a financial institution operating in the EU or serving EU customers, some DORA requirements will apply to you.

‍

The affected UK entities need to comply with the regulation’s prescribed ICT risk management practices, most notably:

• Adopting an ICT risk management framework that protects an organization from third-party cyber threats
• Creating an elaborate incident reporting system that enables quick detection and recovery from incidents
• Performing operational resilience testing to ensure sufficient controls are in place to maintain a solid security posture

‍

If your organization operates exclusively in the UK and doesn’t cater to EU customers or provide services to EU financial entities, compliance with DORA is not obligatory. Still, following the framework’s guidelines could be a strategic move resulting in revenue- and compliance-related benefits like easier access to new markets and improved operational resilience.

‍

Additionally, as financial markets become heavily regulated, your organization may also have to comply with a UK equivalent to DORA in the coming years.

‍

UK’s DORA-adjacent framework: A new legislation on the horizon

After Brexit, the UK no longer needs to align its regulations with those of the EU. In practice, it often adopts EU legislations or adapts its own to ensure alignment with industry-accepted security practices—and DORA is no exception.

‍

In 2022, HM Treasury released a policy paper regarding the legislation of a regime aimed at managing the risk of critical third parties in the finance industry. If you compare the policy paper to DORA’s guidelines and requirements, you’ll see that the two share the same overarching goal.

‍

Still, the proposal remains in development and lags behind DORA. This delay gives the affected UK businesses enough time to prepare for potential regulations by proactively adopting DORA's guidelines.

‍

In the long run, UK financial organizations and ICT providers serving European customers might need to comply with both DORA and its UK equivalent. That’s why it’s a practical option for many organizations to incorporate DORA into their compliance strategy.

‍

Practical reasons to ensure DORA compliance as a UK entity

Here are some practical reasons to ensure DORA compliance:

• Fortified cybersecurity: The regulation outlines numerous controls and processes you can implement to improve your security posture (preliminary ICT risk assessments, operational resilience testing, etc.).
• Increased collaboration transparency: DORA allows (but doesn’t mandate) financial entities to share cyber threat intelligence among themselves. Doing so encourages a more transparent business environment where organizations can evolve together against ever-evolving threats.
• Effective risk management: DORA places significant emphasis on third-party risk management (TPRM), particularly for ICT providers. By adopting the framework, you can improve your TPRM strategy and manage cybersecurity risk more efficiently. 
• Improved business continuity planning: DORA’s guidelines help organizations prepare for security incidents, contributing to an effective business continuity plan. If you still don’t have a contingency plan (or your current one needs an update), the regulation can provide the necessary guidance.
• Enhanced reputation and trustworthiness: DORA improves your organization's trustworthiness by prescribing numerous policies and processes you can implement to safeguard sensitive data. This helps you build and maintain a positive reputation as a reliable vendor or partner.

‍

{{cta_withimage3="/cta-modules"}}

Tips to prepare for DORA compliance

To ensure full DORA compliance with minimal effort, consider these steps:

• Review and adjust your security posture: Perform a comprehensive security review to identify gaps in DORA requirements. Consider including the entire applicable IT infrastructure and all third-party ICTs you work with.
• Map third-party dependencies: Build an inventory of your ICTs and map all process dependencies to understand how each provider’s services impact your operations and attack surface. You should also map out dependencies between internal processes and applications.
• Update your security policies: Most maturing security programs may require updating of security policies, such as those that relate to resilience testing for ICT threat management, to close potential DORA compliance gaps.
• Adopt or build a third-party risk management framework: A TPRM framework formalizes your risk management procedures so that all relevant teams are on the same page. If you can’t build a framework from scratch, you can use established frameworks as references (e.g., NIST CSF or ISO 27001).
• Create an incident response plan: As per Article 17, DORA requires financial entities to “define, establish and implement an ICT-related incident management process.” The process must enable your organization to detect and recover from incidents effectively and notify the affected parties.

‍

Besides these DORA-specific actions, you should follow a best practice that considerably simplifies compliance with any regulation—adopting a capable compliance management solution.

‍

Become DORA-compliant seamlessly with Vanta

Software-supported DORA compliance helps you meet the necessary requirements without guesswork or scattered workflows—and Vanta can help you achieve these benefits. As a comprehensive trust management platform, it automates complex DORA compliance workflows.

‍

Vanta’s dedicated DORA product offers useful features that can support your compliance journey. You can leverage:

• Over 375 integrations with major third-party solutions (including security-focused ones)
• Pre-built templates of documents and policies aligned with DORA’s requirements
• Expert support and guidance regarding the identification and remediation of DORA compliance gaps
• Automated compliance tracking

‍

With Vanta’s extensive solution, you can cut the DORA preparation time to as little as six to ten weeks. More importantly, you can be confident that your organization has all the necessary controls and procedures in place to demonstrate compliance.

‍

Visit the DORA product page to request a personalized demo for your team.

‍

{{cta_simple27="/cta-modules"}}

‍‍

A note from Vanta: Vanta is not a law firm, and this article does not constitute or contain legal advice or create an attorney-client relationship. When determining your obligations and compliance with respect to relevant laws and regulations, you should consult a licensed attorney.