Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Article 13Learning and evolving

1. Financial entities shall have in place capabilities and staff to gather information on vulnerabilities and cyber threats, ICT-related incidents, in particular cyber-attacks, and analyse the impact they are likely to have on their digital operational resilience.

2. Financial entities shall put in place post ICT-related incident reviews after a major ICT-related incident disrupts their core activities, analysing the causes of disruption and identifying required improvements to the ICT operations or within the ICT business continuity policy referred to in Article 11.

Financial entities, other than microenterprises, shall, upon request, communicate to the competent authorities, the changes that were implemented following post ICT-related incident reviews as referred to in the first subparagraph.

The post ICT-related incident reviews referred to in the first subparagraph shall determine whether the established procedures were followed and the actions taken were effective, including in relation to the following:

(a) the promptness in responding to security alerts and determining the impact of ICT-related incidents and their severity;

(b) the quality and speed of performing a forensic analysis, where deemed appropriate;

(c) the effectiveness of incident escalation within the financial entity;

(d) the effectiveness of internal and external communication.

3. Lessons derived from the digital operational resilience testing carried out in accordance with Articles 26 and 27 and from real life ICT-related incidents, in particular cyber-attacks, along with challenges faced upon the activation of ICT business continuity plans and ICT response and recovery plans, together with relevant information exchanged with counterparts and assessed during supervisory reviews, shall be duly incorporated on a continuous basis into the ICT risk assessment process. Those findings shall form the basis for appropriate reviews of relevant components of the ICT risk management framework referred to in Article 6(1).

4. Financial entities shall monitor the effectiveness of the implementation of their digital operational resilience strategy set out in Article 6(8). They shall map the evolution of ICT risk over time, analyse the frequency, types, magnitude and evolution of ICT-related incidents, in particular cyber-attacks and their patterns, with a view to understanding the level of ICT risk exposure, in particular in relation to critical or important functions, and enhance the cyber maturity and preparedness of the financial entity.

5. Senior ICT staff shall report at least yearly to the management body on the findings referred to in paragraph 3 and put forward recommendations.

6. Financial entities shall develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes. Those programmes and training shall be applicable to all employees and to senior management staff, and shall have a level of complexity commensurate to the remit of their functions. Where appropriate, financial entities shall also include ICT third-party service providers in their relevant training schemes in accordance with Article 30(2), point (i).

7. Financial entities, other than microenterprises, shall monitor relevant technological developments on a continuous basis, also with a view to understanding the possible impact of the deployment of such new technologies on ICT security requirements and digital operational resilience. They shall keep up-to-date with the latest ICT risk management processes, in order to effectively combat current or new forms of cyber-attacks.

DORA, the European Union regulation on digital operational resilience, Article 13

The feedback loop, made a requirement. Entities need the capabilities and staff to gather information on vulnerabilities, cyber threats and incidents, and to analyse their likely impact on resilience.

After a major ICT-related incident that disrupts core activities, there must be a post-incident review of causes and required improvements. It must determine whether procedures were followed and the actions taken were effective, including promptness in responding to alerts and assessing impact and severity, quality and speed of forensic analysis where appropriate, escalation, and internal and external communication. Entities other than microenterprises tell competent authorities, on request, what changes they made.

Lessons from resilience testing and real incidents, including difficulties when plans were activated, feed continuously into the ICT risk assessment process and drive reviews of the framework. Senior ICT staff must report on these findings to the management body at least yearly, with recommendations. Entities must monitor how well the resilience strategy is working, map how ICT risk evolves, and analyse the frequency, types and patterns of incidents.

Security awareness and resilience training must be compulsory modules, for all employees and senior management, at a level matching their roles. Where appropriate, ICT third-party service providers are included in the training. Entities other than microenterprises must also monitor technological developments continuously and keep up to date with ICT risk management practice.

What is in the packs for this

Each one helps with this requirement.

  • DORA Article-to-Control Mapping LibraryExcel

    in DORA ICT Risk & Resilience Readiness

    Requirement Library rows RQ-20, RQ-21: each gives the provision in plain words, what an entity must be able to show and the documents that help.

  • DORA Readiness Self-AssessmentExcel

    in DORA ICT Risk & Resilience Readiness

    Readiness items RM-07 rate how ready the entity is for the provision, with the evidence behind each rating and the gap.

  • ICT Risk Management Framework Document TemplateWord

    in DORA ICT Risk & Resilience Readiness

    Statements FW-55 and FW-56 on learning from vulnerabilities, threats, incidents and tests.

  • DORA Gap & Remediation TrackerExcel

    in DORA ICT Risk & Resilience Readiness

    The Gaps sheet tracks improvements from post-incident reviews and carries lessons from tests and incidents into the risk assessment as dated actions.

  • Operational Security Metrics DashboardExcel

    in Cybersecurity Metrics & Reporting Programme

    The trend and direction view monitors ICT risk and the effectiveness of measures over time.

  • Role-Based Security Training MatrixExcel

    in Security Awareness Programme

    The financial-entity note sets training for all staff and senior management at a depth that fits each role.

  • Training Completion & Evidence RegisterExcel

    in Security Awareness Programme

    Keeps the evidence that the compulsory training reached all employees and senior management.

Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.