This pillar establishes a robust governance framework for IT risk management. It includes structured policies and processes to identify, assess and mitigate potential risks, thereby ensuring ongoing operational resilience.
Ensure the long-term future of your company !
New compliance standards regularly emerge to regulate different entities and businesses. It is therefore crucial to keep abreast of the specific regulations with which your company must comply, in order to avoid any legal penalties.
Rsecure can help you comply with the most stringent security standards such as ISO 27001, DORA, NIS and NIS 2, as well as the directives issued by your national regulator. We use our expertise to help you navigate this complex regulatory landscape imposed to IT sector, providing you with the guidance you need to ensure that your business meets all its legal and security obligations.
Whether you are a regulated or non-regulated business, take advantage of our support for your cybersecurity audits!
Opt for digital operational resilience with DORA
The Digital Operational Resilience Act (DORA), enacted by the European Union in 2023 and applicable from 17 January 2025, represents a significant step forward in the regulation of digital operational resilience. This legislation aims to strengthen the IT security of financial entities such as banks, insurance companies and investment firms, while harmonising the rules on operational resilience in the financial sector.
The operational objective of DORA is to ensure that entities in Europe’s financial sector are able to withstand, respond to and recover quickly from any incident that might affect digital operations. This includes cyber-attacks, technical failures and any types of operational crises.
Who is affected by DORA ?
DORA is not limited to large banks and insurance companies, it applies to a wide range of entities. In fact, the legislation covers 20 types of financial entities and third-party providers of information and communication technology services. It applies to, but is not limited to :
- Banks
- Insurance companies,
- Investment firms,
- Payment service providers,
- Electronic money institutions,
- Fund management companies,
- Participative financing platforms.
DORA’s 5 pillars of operational resilience
The DORA law is built around 5 main pillars to strengthen the operational resilience of companies in the field of information and communication technologies. These pillars are :
ICT risk management
Incident reports
A standardised classification enables major incidents to be reported uniformly across the European Union. This includes the production of anonymous reports, facilitating communication and transparency at European level to better prevent and manage future incidents, which must be reported to the regulator.
Operational resilience testing
This pillar requires a comprehensive programme of technical testing, including large-scale live testing by independent testers. These standard tests, including penetration tests, must be carried out every three years to assess the resilience of systems against threats. There are also Threat-Led Penetration Tests, which must be carried out once every three years for the financial entities concerned.
Third-party ICT risk management
To best manage the risks associated with suppliers and other parties, this pillar requires the development of standardised strategies, policies and information registers. It also includes guidelines for risk assessment, resilience contracts, and a framework for monitoring critical suppliers to ensure compliance and resilience.
Information sharing and cyber security
This final pillar focuses on putting in place effective arrangements for sharing information about cyber threats and vulnerabilities. The aim is to promote close collaboration between the various stakeholders to enhance cybersecurity at EU level.
We can help you comply with the Digital Operational Resilience Act by supporting you in implementing best practice, including our on-demand CISO service for ongoing processes and controls.
We can also help in the form of a compliance project, which will help you put the regulatory framework in place.
When you turn to Rsecure, you benefit from in-depth expertise in IT security and resilience, enabling you to strengthen your IT systems and processes to meet compliance requirements and minimise the risks associated with ICT.
We can help you with other regulations !
There are, of course, other important regulations and standards to consider, such as ISO, NIS, NIS 2 and national regulations. ISO are the most common standards on which regulation framework are based. Within the ISO stack, ISO27001 is the Standard for information systems security and ISO 27005 focuses on security risk management.
The NIS and NIS 2 (Network and Information Security) Directives are EU regulations designed to strengthen the cyber resilience of critical organisations within the EU. NIS 2 extends the scope of the NIS Directive by imposing more stringent security requirements and introducing incident management obligations for a wider range of critical sectors.
The main objective is to ensure a high level of security and resilience for critical infrastructures that support the smooth functioning of society across Europe.
Customized support and audits for total cybersecurity compliance
At Rsecure, our experts help you comply with all these standards, tailoring our solutions to your specific needs, business and budget.
In addition to these services, we offer customised security and technical audits, tailored to all sectors, to assess your regulatory compliance and cybersecurity maturity level. Whether you are regulated or not, these audits are a unique opportunity to assess your cyber maturity or your position with regard to the regulations to which your company is subject, whether towards the national regulator, the Insurance commission or the Luxembourg Bar Association.
Discover our HOP methodology
To meet your cybersecurity needs, we have developed the H.O.P methodology, based on three pillars: People, tOols and Processes. This approach forms the basis of our cybersecurity services. With H.O.P, you get a solid foundation for securing your IT systems. We can also help you implement and monitor your IT security.
Human
Human error is the leading cause of data leakage and loss. That’s why it’s essential to regularly train and test employees to detect and respond to threats. In the Human aspects of our methodology, you’ll find, for example, individual and collective cyber maturity assessments, auditing services, phishing tests, and tailored training.
tOols
It is essential to measure and detect vulnerabilities in company systems using a range of tools and practices, such as back-up, asset management and antivirus. These tools enable you to effectively protect your IT systems against threats and avert the dangers that jeopardize your company.
Process
This implies putting in place mechanisms, standards and policies that will serve to frame and supervise the behavior of people within the company. We can also help you make your company compliant with various standards (ISO27001, NIST, DORA…).
Need to strengthen the security of your infrastructure?
Contact us today to strengthen the security of your infrastructure and ensure your regulatory compliance!
Let’s assess your compliance