{"id":54,"date":"2025-02-27T13:13:44","date_gmt":"2025-02-27T13:13:44","guid":{"rendered":"https:\/\/www.intrinsec.com\/?page_id=54"},"modified":"2025-10-10T12:21:43","modified_gmt":"2025-10-10T12:21:43","slug":"conformite-dora","status":"publish","type":"page","link":"https:\/\/www.intrinsec.com\/en\/conformite-dora\/","title":{"rendered":"DORA Compliance"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

\n DORA -<\/span> Digital Operational Resilience Act<\/span> <\/h1>\n \t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t<\/i>\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\tMake a request<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

From January 2025, European financial organizations will have to demonstrate that they are capable of withstanding any major digital incident.<\/p>

DORA is not simply a compliance obligation: it is a\u00a0demanding and cross-functional framework<\/strong>, which structures the technological, cyber, resilience, supplier and governance requirements across the entire European financial ecosystem.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Our DORA support program assesses information systems and IT environments to define an operational security strategy. We map digital services, servers, and cloud dependencies to reduce exposure to vulnerabilities and IT risks. The approach combines security audits and risk analysis to prioritize actions and improve security levels. We help formalize a security policy and access control procedures to better secure systems and processes. Technical recommendations include encryption, cryptography, and security measures to protect sensitive data and confidentiality. The program includes the evaluation of service providers and subcontractors to contractually define obligations regarding security and personal data protection. Our audits identify vulnerabilities exploitable by cybercriminals and define actionable remediation plans. We strengthen authentication and password policies to limit the risks of hacking and unauthorized access. The DORA scenarios tested simulate real-world cyberattacks to measure the resilience of IT systems and the overall system security. We offer security solutions (EDR, SIEM, segmentation) tailored to the scope to industrialize the detection and response to security incidents. Securing information systems requires alignment between IT, Risk, and operational teams to ensure appropriate and traceable measures. Our deliverables provide audited evidence to demonstrate operational resilience and incident management in accordance with regulatory requirements. Control over data processing and the protection of personal data are guaranteed through technical controls and contractual reviews with data processors. We assess the digital security of endpoints and connected devices to limit attack vectors and protect their data in transit. The DORA strategy includes an IT risk matrix linking business impact, probability, and a prioritized remediation plan. Our cryptography recommendations specify encryption methods at rest and in transit to ensure information security. We conduct periodic audits to monitor changes in security posture and verify the effectiveness of deployed security measures. The system integrates SOC monitoring and incident playbooks to accelerate the detection and management of security incidents. Formalizing an IT security policy clarifies responsibilities, including the obligations of service providers and subcontractors. We support compliance with data protection regulations to ensure privacy protection is integrated into the data lifecycle. Access controls and server hardening reduce exploitable vulnerabilities and limit exposure to targeted cyberattacks. Digital transformation is secured by integrating security by design and DevSecOps to secure systems from the outset. Request a DORA diagnostic to assess your security posture, prioritize measures, and protect your sensitive data.<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Your challenges in relation to DORA<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\n
\n\n \n
\n\n
\n\n <\/path><\/svg>\n <\/div>\n \n

Identify precisely whether you fall under the DORA framework (banks, insurance companies, fintechs, IT providers, etc.).<\/h3><\/div>\n <\/div>\n\n
\n \n
\n <\/div>\n\n \n <\/div>\n <\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\n
\n\n \n
\n\n
\n\n <\/path><\/svg>\n <\/div>\n \n

Ensure the continued operational resilience of all your critical digital functions.<\/h3><\/div>\n <\/div>\n\n
\n \n
\n <\/div>\n\n \n <\/div>\n <\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\n
\n\n \n
\n\n
\n\n <\/path><\/svg>\n <\/div>\n \n

Build and test realistic business continuity and incident response plans (IT, cyber, crisis).<\/h3><\/div>\n <\/div>\n\n
\n \n
\n <\/div>\n\n \n <\/div>\n <\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\n
\n\n \n
\n\n
\n\n <\/i>\n <\/div>\n \n

Reduce your critical dependencies on non-resilient or non-compliant IT providers.<\/h3><\/div>\n <\/div>\n\n
\n \n
\n <\/div>\n\n \n <\/div>\n <\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\n
\n\n \n
\n\n
\n\n <\/path><\/svg>\n <\/div>\n \n

Demonstrate, through formal evidence, that your governance has digital risks under control.<\/h3><\/div>\n <\/div>\n\n
\n \n
\n <\/div>\n\n \n <\/div>\n <\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

The 5 DORA pillars<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

According to the European regulation adopted at the end of 2022, DORA is based on the following major blocks:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\n
\n\n \n
\n\n
\n\n <\/path><\/svg>\n <\/div>\n \n \n <\/div>\n\n
\n

ICT Risk Management<\/h4><\/div>\n
\n <\/div>\n\n \n <\/div>\n <\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\n
\n\n \n
\n\n
\n\n <\/path><\/svg>\n <\/div>\n \n \n <\/div>\n\n
\n

Serious Incident Notifications<\/h4><\/div>\n
\n <\/div>\n\n \n <\/div>\n <\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\n
\n\n \n
\n\n
\n\n <\/path><\/svg>\n <\/div>\n \n \n <\/div>\n\n
\n

Advanced digital resilience testing<\/h4><\/div>\n
\n <\/div>\n\n \n <\/div>\n <\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\n
\n\n \n
\n\n
\n\n <\/path><\/svg>\n <\/div>\n \n \n <\/div>\n\n
\n

Risk management via third-party ICT providers<\/h4><\/div>\n
\n <\/div>\n\n \n <\/div>\n <\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\n
\n\n \n
\n\n
\n\n <\/path><\/svg>\n <\/div>\n \n \n <\/div>\n\n
\n

Exchange of information regarding cyber threats<\/h4><\/div>\n
\n <\/div>\n\n \n <\/div>\n <\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Our services to meet DORA requirements<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

We support you at every stage of the program, from regulatory translation to tooling and proof.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\t\t\t\t\n\t\t\t\t\t
\n\t\t\t\t\n\n\n\t\t\t\t\t\n\t\t\t\t\t\t<\/path><\/svg>\n\n\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t<\/div>\n\t\t\n\t\t\t\t\n\t\t\t
\n\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t

\n\t\t\t\t\n\t\t\t\t\tICT Risks\t\t\t\t<\/span>\n\t\t\t<\/h3>\n\t\t\n\n\t\t\n\t\t\t\t\t\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Key services offered<\/h4>

EBIOS mapping, ISMS, dependency analysis<\/p>

Key objective<\/h4>

Identify and manage all digital risks<\/p>\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\n\t\t\n\t\t\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\t\t\t\t\n\t\t\t\t\t
\n\t\t\t\t\n\n\n\t\t\t\t\t\n\t\t\t\t\t\t<\/path><\/svg>\n\n\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t<\/div>\n\t\t\n\t\t\t\t\n\t\t\t
\n\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t

\n\t\t\t\t\n\t\t\t\t\tPhysical intrusion\t\t\t\t<\/span>\n\t\t\t<\/h3>\n\t\t\n\n\t\t\n\t\t\t\t\t\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Key services offered<\/h4>

SOC Reporting Procedure \/ Strengthening<\/p>

Key objective<\/h4>

Reduce detection and notification delays<\/p>\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\n\t\t\n\t\t\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\t\t\t\t\n\t\t\t\t\t
\n\t\t\t\t\n\n\n\t\t\t\t\t\n\t\t\t\t\t\t<\/path><\/svg>\n\n\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t<\/div>\n\t\t\n\t\t\t\t\n\t\t\t
\n\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t

\n\t\t\t\t\n\t\t\t\t\tPhishing & social engineering\t\t\t\t<\/span>\n\t\t\t<\/h3>\n\t\t\n\n\t\t\n\t\t\t\t\t\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Key services offered<\/h4>

Crisis simulations, TIBER-EU, sectoral Red Teams<\/p>

Key objective<\/h4>

Testing the organization's actual resilience<\/p>\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\n\t\t\n\t\t\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\t\t\t\t\n\t\t\t\t\t
\n\t\t\t\t\n\n\n\t\t\t\t\t\n\t\t\t\t\t\t<\/path><\/svg>\n\n\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t<\/div>\n\t\t\n\t\t\t\t\n\t\t\t
\n\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t

\n\t\t\t\t\n\t\t\t\t\tData exfiltration test\t\t\t\t<\/span>\n\t\t\t<\/h3>\n\t\t\n\n\t\t\n\t\t\t\t\t\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Key services offered<\/h4>

Supplier due diligence, SSI clauses, dependency mapping<\/p>

Key objective<\/h4>

Securing the external IT ecosystem<\/p>\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\n\t\t\n\t\t\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\t\t\t\t\n\t\t\t\t\t
\n\t\t\t\t\n\n\n\t\t\t\t\t\n\t\t\t\t\t\t<\/path><\/svg>\n\n\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t<\/div>\n\t\t\n\t\t\t\t\n\t\t\t
\n\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t

\n\t\t\t\t\n\t\t\t\t\tActive Directory compromise simulation\t\t\t\t<\/span>\n\t\t\t<\/h3>\n\t\t\n\n\t\t\n\t\t\t\t\t\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Key services offered<\/h4>

CTI mechanism integrated into risk governance<\/p>

Key objective<\/h4>

Anticipating threats related to digital chains<\/p>\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\n\t\t\n\t\t\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Examples of DORA missions<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Offensive simulations must be integrated into an overall strategy to maximize their effectiveness.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

DORA multi-entity diagnostic for a banking group (European material + ISO + LPM)<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

TIBER-EU simulation: Directed Threat Actor scenario + crisis test + PRA report<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

DORA-ready contractual kit for critical supplier reviews (PROCUREMENT + LEGAL)<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Mapping of critical digital services, IT & cloud flow checkpoints<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

DORA roadmap in 12-24 months: quick wins, trail map, priority dependencies<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t