Article 45Information-sharing arrangements on cyber threat information and intelligence
1. Financial entities may exchange amongst themselves cyber threat information and intelligence, including indicators of compromise, tactics, techniques, and procedures, cyber security alerts and configuration tools, to the extent that such information and intelligence sharing:
(a) aims to enhance the digital operational resilience of financial entities, in particular through raising awareness in relation to cyber threats, limiting or impeding the cyber threats’ ability to spread, supporting defence capabilities, threat detection techniques, mitigation strategies or response and recovery stages;
(b) takes places within trusted communities of financial entities;
(c) is implemented through information-sharing arrangements that protect the potentially sensitive nature of the information shared, and that are governed by rules of conduct in full respect of business confidentiality, protection of personal data in accordance with Regulation (EU) 2016/679 and guidelines on competition policy.
2. For the purpose of paragraph 1, point (c), the information-sharing arrangements shall define the conditions for participation and, where appropriate, shall set out the details on the involvement of public authorities and the capacity in which they may be associated to the information-sharing arrangements, on the involvement of ICT third-party service providers, and on operational elements, including the use of dedicated IT platforms.
3. Financial entities shall notify competent authorities of their participation in the information-sharing arrangements referred to in paragraph 1, upon validation of their membership, or, as applicable, of the cessation of their membership, once it takes effect.
DORA, the European Union regulation on digital operational resilience, Article 45
Voluntary information sharing between financial entities: cyber threat information and intelligence, including indicators of compromise, tactics, techniques and procedures, cyber security alerts and configuration tools. The sharing must aim to strengthen digital operational resilience by raising awareness, limiting the spread of threats, supporting defensive capability, detection techniques, mitigation strategies or response and recovery. It must happen within trusted communities of financial entities, through arrangements that protect the sensitive information and follow rules of conduct that respect business confidentiality, personal data protection under the GDPR and competition-policy guidelines.
Those arrangements must set the conditions for participation and, where appropriate, how public authorities and ICT third-party service providers may be involved, and operational details such as dedicated platforms.
Entities notify their competent authority of joining an arrangement once membership is validated, and of leaving once that takes effect.
The parallel with NIS2 is close. NIS2 Article 29 also lets entities share cybersecurity information voluntarily, and requires Member States to ensure that essential and important entities notify authorities of joining or withdrawing. The difference is scope: NIS2 covers communities of essential and important entities and, where relevant, their suppliers or service providers, whereas this permission is for financial entities among themselves. DORA does not itself set out those rules of conduct.
What is in the packs for this
From DORA ICT Risk & Resilience Readiness. Each one helps with this requirement.
DORA Article-to-Control Mapping LibraryExcel
Requirement Library rows RQ-52: each gives the provision in plain words, what an entity must be able to show and the documents that help.
DORA Readiness Self-AssessmentExcel
Readiness items IS-01 rate how ready the entity is for the provision, with the evidence behind each rating and the gap.
DORA Documentation & Evidence ChecklistExcel
Evidence records EV-34: the records a supervisor can ask for under the provision, with who keeps them and for how long.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.