The purpose of DORA, which came into force on 17th January 2025, is to establish a risk management framework for financial services firms to ensure there are appropriate controls and processes to withstand a cyberattack. The act has five main pillars and the focus is on implementing operational resilience:
- ICT risk management
- Incident reporting
- Digital operational resilience testing
- Third-party risk management
- Information sharing
Effective baseline cybersecurity controls are essential to protect a firm from a cyberattack. Cyber maturity levels vary within organisations according to budgets, risk management resources and whether protection is managed internally or by a third party. It is not possible to cover all eventualities as cyber risks are constantly evolving and producing new threats. The more layers of protection that are in place the better the chance that cyberattacks can be managed or even avoided.
Lines of defence
DORA should be considered the first layer of protection for businesses; however, because risk is dynamic and contains an element of uncertainty, insurance will always be needed as a backup to address residual risk. This is where cyber insurance can be an important part of a firms risk management strategy.
Cyber insurance has developed exponentially in recent years, but not without it’s challenges. Market conditions have pushed premiums up and policy coverage has been tightened due to the rising number of claims from ransomware and phishing attacks. As a result, insurers now insist on the presence of baseline cybersecurity measures, such as multi-factor authentication (MFA), end-to-end encryption and regular back-ups isolated from the main network. This has made the market sustainable and insurers and policyholders are benefiting from improved risk management which can avoid the most unsophisticated of cyberattacks.
Insurance after DORA
DORA certification makes buying cyber insurance easier because there will be a sufficient level of cybersecurity for insurers to consider coverage. Taking out a cyber insurance policy will provide an added layer of protection against cyber risk.
Cyber insurance is more than a contract detailing the scope of coverage. It is a service offering recognising the unique and changing dynamics of cyber risk and the importance of building cyber resilience.
A standard cyber insurance policy provides modular coverage for the following areas:
- Incident Response: One of the main benefits of the policy is 24/7 Incident Response Services. In the event of a cyber incident insurers provide immediate access to a panel of expert incident responders to help manage and mitigate a cyber event.
- First Party: Cyber Extortion, Business Interruption, Data Reconstitution
- Third Party: Privacy Liability, Media Liability, Payment Card Industry (PCI) Liability
Additionally, cyber insurers now provide additional pro-active services as part of the insurance:
- Continuous monitoring of the network with alerts to critical vulnerabilities.
- Non-intrusive testing on a pre-bind basis to reveal any current threats.
- Ancillary benefits such as password management, phishing simulation and training, with access to cyber security firms at discounted rates.
The introduction of DORA is a welcome step that makes cyber insurance more attainable and increases the level of protection for financial services firms. To find out more about cyber insurance or to assess your cyber risks, contact Elmore’s Cyber Insurance Team.