DORA webinars: getting your act together

Operationalise your compliance now and ensure you're audit-ready
15th - 18th October at 10:15 daily4 x 30 minute sessions packed with value

David Thomas, Head of Cyber Resilience at ITHQ shares his extensive knowledge of policy, frameworks and technology.
Understand how to get the proof points you need to satisfy the auditors:

● Access Control Management● Vulnerability Management● Network Management, Security and Maintenance● Data Resilience

Sign up


A single sign up guarantees your place at all four webinars.
You will also receive all the recordings automatically.

Get the proof points you need to be certain of compliance

Simplifying DORA, streamlining compliance and vetting your suppliers

All the background you need to get the most out of each 30 minute webinar. Each session will cover a new focus area of compliance, so the information on this page is designed to be a handy reference.

Illustration

Breaking down the complex

4 domains of compliance

There are four key requirements for all businesses that must comply with DORA ...

Illustration

How streamlined are your compliance efforts?

CIS Critical Security Controls

Using a recommended framework such as the CIS critical controls can smooth your path ...

Illustration

Securing your supply chain

Third party security checks

Every business is a link in a chain. Understanding where the weakest links sit is critical ...

Webinar series: Operationalising DORA compliance

You understand the legislation, you know why it's being enforced.
Now you need to see proof points that guarantee your organisation complies with the new regulations.
Using the strategies and approach our experts share, you will drive your teams to be ready for the auditors in January.

Head of Cyber Resilience at ITHQ, David Thomas leads every webinar. David is a highly qualified and experienced CISO holding (ISC)² CISSP, ISO 27001 Certified ISMS Lead Implementer, CISA Certified Information Systems Auditor, and SABSA Chartered Security Architect Foundation (SABSA-FCP).

Sign up once to register for all four

Recordings forwarded automatically in case you have to miss one

15th - 18th October, every day at 10:15

1. Access Control Management

Who's on your networks, what can they see and what can they do?

Guest speaker: privileged access management specialist, Scott Shields, from Delinea.

● Inventory and control: enterprise assets● Inventory and control: software assets● Account management● Access control management

2. Vulnerability Management

Where are your weakest points, how do you find them and how do you fix them?

Guest speaker: attack surface management expert, David Brookes-Smith, from Rapid7

● Continuous vulnerability assessment● Audit log management● Penetration testing

3. Network Management, Security & Maintenance

Is your network operating efficiently, is it secure and how do you maintain it?

Guest speaker: Unified cloud monitoring expert, Nik Grove, ITHQ

● Secure configuration enterprise assets and software● Network infrastructure management● Network monitoring and defense● Application software security

4. Data Resilience

How can your data be attacked, how far can the attack go and what happens if your data gets wiped?

Guest speaker: Cyber insurance expert from Sutton Winson

● Email and web browser protections● Malware defenses● Data protection● Data recovery● Incident response management

Sign up for all four webinars with one form to get the full picture

You will automatically receive recordings of any sessions you can't make. You'll be amazed how much value we can squeeze into 30 minutes.

DORA: the 4 domains to compliance

Anticipate, withstand, recover, evolve

Financial services firms generated 12% of the UK's economic output in 2023. DORA is an EU regulation that will make this critical sector more resilient to cyber attacks by reducing risk and improving governance.
The four domains of DORA that must be demonstrated and evidenced are:
● ICT risk management and governance● Your system for incident response and reporting● Your protocol for digital operational resilience testing● Your third-party risk management
Information sharing is recommended as well.
Breaches are inevitable, despite the layers of security adopted by most companies today. DORA is about cultivating your ability to anticipate, withstand, recover and evolve from a significant attack.

Illustration

ICT risk management & governance

Strategise security updates to ensure budget is allocated and to eliminate knee-jerk spend.

Incident response and reporting

Create a process that spans discovery, response and reporting of an incident and share it.

Digital operational resilience testing

Scenario-based testing is critical. Face the worst cases regularly so that you are fully prepared.

Third-party risk management

Verify compliance and security credentials of all third party providers. Review annually.

The Centre for Internet Security 18 Critical Security Controls

Complying with DORA can be significantly streamlined if you follow an established, recommended framework that guides your team in an efficient way to demonstrate and evidence your solutions that cover critical areas of data security.

The grid below represents the CIS Critical Security Controls with the three Implementation Groups below the grid. Compliance with the CIS Critical Controls also means you could reduce your cyber insurance premiums and enable you to streamline compliance efforts with PCI DSS, NIST CSF and other industry regulations.

Illustration
Illustration
Illustration
Illustration
Illustration
Illustration
Illustration
Illustration
Illustration
Illustration
Illustration
Illustration
Illustration
Illustration
Illustration
Illustration
Illustration
Illustration

Implementation Groups (IGS)

Removing guesswork for getting started quickly, with a total of 153 safeguards required for full compliance

Each group provides more safeguards. The number of safeguards an enterprise should implement is dictated by the group in which it falls. To comply with DORA, most financial services organisations all fall into IG3.

Illustration

IG1: SMEs with limited IT & cyber experts

56 Safeguards Essential cyber hygiene

The definition of essential cyber hygiene, IG1 represents a minimum standard of security for simple-structure organisations. Data sensitivity is low. Gives defence against broad, non-specific attacks.

IG2: Mid-size with dedicated experts

74 Safeguards Medium cyber security for complex needs

For businesses managing IT infrastructure across multiple departments with differing risk profiles, IG2 incorporates IG1 and helps enterprises with increased operational complexity reduce risk further.

IG3: Specialist cyber leads and teams

23 Safeguards Expert security for publicly sensitive data

IG3 incorporates IG2 and IG1, helping firms with expert IT security teams secure sensitive, confidential data. Successful attacks could significantly harm public welfare.

Are your service providers DORA compliant?

Third party security

Adopt a stance of zero trust and zero assumption when it comes to managing the security of your supply chain

Under DORA, you will be expected to scrutinise the security measures of any supplier who might access your data or infrastructure. As attackers target upstream activities, the potential for multiplying damages escalates dramatically. Instead of targeting a single company, they can compromise entire networks of businesses that operate in tandem.
Checking credentials such as ISO 27001, ISO 9001 and Cyber Essentials Plus is always a good place to start.

The National Cyber Security Centre (NCSC), in partnership with the Centre for the Protection of National Infrastructure (CPNI), stress the importance of dynamic, proactive strategies. Their latest set of guidelines in 2021 further refines the defences organisations must build to protect not only their own interests but those of their suppliers and partners. These are categorised into four essential stages:

  • 1. Risk Assessment and Protection Prioritisation

    Begin by developing an exhaustive understanding of your supply chain. Evaluate the sensitivity of your operations and data access points to establish who your direct and indirect suppliers are, along with assessing their security postures.

    The necessity for tight security measures becomes apparent in ensuring that suppliers uphold standards compatible with yours. Documentation of these aspects forms the backbone of creating risk profiles and defining stringent data protection standards expected from all parties involved.

  • 2. Establishing Control, Facilitating Communication, and Offering Support

    With a comprehensive perspective of the supply chain's structure, pinpoint potential vulnerabilities and direct your efforts on mitigating these weak points. Frequent evaluations reveal patterns and dependencies that may necessitate diversification of your supplier base to reduce concentrated risks.

    Communication about your security expectations and the repercussions of non-compliance must be clear to every supplier. Leading by example, foster a culture that underscores the significance of security and facilitate mechanisms for managing and mitigating incidents.

  • 3: Validation and Assurance

    Confidence in your strategies is mandatory, and so is their validation. Effective contract management ensures that security clauses, like those requiring Cyber Essentials Plus or ISO 27001 certification, are always current and relevant.

    Watch for extended, unchecked contracts, which can become obsolete as security paradigms shift. Introduce clauses like the right to audit, encouraging mutual compliance and regular revisions among your partners.

  • 4: Continuous Improvement and Adaptation

    As the business environment and potential threats evolve, so should your strategies and those of your partners. Promote an environment where continuous improvement is both encouraged and supported, aligning with strategic goals which enhance competitive prowess and ensure resilience.

    Solidifying supply chain security is a collective responsibility. It involves creating synergetic partnerships based on shared values and continuous dialogue, ensuring all nodes within the chain are robust enough to withstand and adapt to the challenges posed by modern cybersecurity threats.

Image placeholder

Want to know more? Let's talk