DORA – Digital Operational Resilience Act

DORA

Art 9.4 (a)

DORA Requirement
Develop and document an information security policy defining rules to protect the availability, authenticity, integrity and confidentiality of data, information assets and ICT assets, including those of their customers, where applicable.

CRYPTAS contribution
Consulting and assistance in developing and documenting such policies and rules.

Art 9.4 (c)

DORA Requirement
Implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only, and establish to that end a set of policies, procedures and controls that address access rights and ensure a sound administration thereof.

CRYPTAS contribution
Egofy converged Smartcard solution, with Legic and Mifare Desfire for physical access, combined with X.509 certificates, FIDO-2 and OTP for logical Multi-factor authentication. Credential Management for administration of policies and access rights.

Art 9.4 (d)

DORA Requirement
Implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated
control systems, and protection measures of cryptographic keys.

CRYPTAS contribution
Authentication solution, including PKI and Credential Management systems.

Art 15

DORA Requirement
Further harmonization of ICT risk management tools, methods, processes and policies.

CRYPTAS contribution
See contributions relating to Draft RTS 2024-01/JC 2023 86.

Draft RTS 2024-01/JC 2023 86

Art 7.2 and Art 7.3

DORA Requirement
Financial entities shall identify and implement controls to protect cryptographic keys through their whole lifecycle against loss, unauthorized access, disclosure and modification. The controls shall be designed taking into account the results of the approved data classification and the ICT risk assessment processes. Financial entities shall develop and implement methods to replace the cryptographic keys in the case of lost, compromised or damaged keys.

CRYPTAS contribution
Documented key management policies, to be implemented in each of the key-consuming ICT systems, and with the help of an Enterprise Key Management solution. An HSM solution is needed to secure the keys.

Art 7.4 and Art 7.5

DORA Requirement
Financial entities shall create and maintain a register for all certificates and certificate-storing devices for at least ICT assets supporting critical or important functions. The register shall be kept up-to-date. Financial entities shall ensure the prompt renewal of certificates in advance of their expiration.

CRYPTAS contribution
Certificate discovery.
Certificate lifecycle management solution.

Draft RTS 2024-01/JC 2023 86

Art 6.1

DORA Requirement
Financial entities shall develop, document and implement a policy on encryption and cryptographic controls, with a view to preserve the availability, authenticity, integrity and confidentiality of data.

CRYPTAS contribution
Consulting on best practices, proportionate policies and implementation architecture. CRYPTAS also supports documenting and implementation of such policies.

Art 6.2 (a)

DORA Requirement
Rules for the encryption of data at rest and in transit.

CRYPTAS contribution
360° encryption solution (file & folder, volume encryption, transparent database encryption, cloud data encryption)
SMIME email encryption and related certificate provisioning.

Art 6.2 (c)

DORA Requirement
Rules for the encryption of internal network connections and traffic with external parties.

CRYPTAS contribution
Solutions using SSL/TLS certificates. Internal connections and traffic protected through Enterprise PKI. An enterprise PKI always relies on an HSM solution to protect the keys. External traffic is protected with public trust certificates. Certificate Lifecycle Management becomes an important tool to manage this requirement.

Art 6.2 (d) and Art 7.1

DORA Requirement
Provisions for cryptographic key management ... managing cryptographic keys through their whole lifecycle, including generating, renewing, storing, backing up, archiving, retrieving, transmitting, retiring, revoking and destroying keys.

CRYPTAS contribution
Enterprise Key Management solution. PKI and CLM for managing the lifecycle of certificates and related keys. An HSM solution is needed to secure the keys.

Draft RTS 2024-01/JC 2023 86

Art 8

DORA Requirement
Policies and Procedures for ICT Operations, including:

• Secure installation, maintenance
• Backup-Restore
• Audit trail , system log
• Separation of production from dev + test
• Support and escalation contacts
• System restart, roll-back, recovery

CRYPTAS contribution
CRYPTAS supplied solutions and CRYPTAS managed services have been built, operated, and documented to the principles of Art 8 already before DORA was put in place.