DORA webinars: getting your act together
Operationalise your compliance now and ensure you're audit-ready
15th - 18th October at 10:15 daily4 x 30 minute sessions packed with value
David Thomas, Head of Cyber Resilience at ITHQ shares his extensive knowledge of policy, frameworks and technology.
Understand how to get the proof points you need to satisfy the auditors:
● Access Control Management● Vulnerability Management● Network Management, Security and Maintenance● Data Resilience
Sign up
A single sign up guarantees your place at all four webinars.
You will also receive all the recordings automatically.
Get the proof points you need to be certain of compliance
Simplifying DORA, streamlining compliance and vetting your suppliers
All the background you need to get the most out of each 30 minute webinar. Each session will cover a new focus area of compliance, so the information on this page is designed to be a handy reference.
Breaking down the complex
4 domains of compliance
There are four key requirements for all businesses that must comply with DORA ...
How streamlined are your compliance efforts?
CIS Critical Security Controls
Using a recommended framework such as the CIS critical controls can smooth your path ...
Securing your supply chain
Third party security checks
Every business is a link in a chain. Understanding where the weakest links sit is critical ...
Webinar series: Operationalising DORA compliance
You understand the legislation, you know why it's being enforced.
Now you need to see proof points that guarantee your organisation complies with the new regulations.
Using the strategies and approach our experts share, you will drive your teams to be ready for the auditors in January.
Head of Cyber Resilience at ITHQ, David Thomas leads every webinar. David is a highly qualified and experienced CISO holding (ISC)² CISSP, ISO 27001 Certified ISMS Lead Implementer, CISA Certified Information Systems Auditor, and SABSA Chartered Security Architect Foundation (SABSA-FCP).
Sign up once to register for all four
Recordings forwarded automatically in case you have to miss one
15th - 18th October, every day at 10:15
1. Access Control Management
Who's on your networks, what can they see and what can they do?
Guest speaker: privileged access management specialist, Scott Shields, from Delinea.
● Inventory and control: enterprise assets● Inventory and control: software assets● Account management● Access control management
2. Vulnerability Management
Where are your weakest points, how do you find them and how do you fix them?
Guest speaker: attack surface management expert, David Brookes-Smith, from Rapid7
● Continuous vulnerability assessment● Audit log management● Penetration testing
Sign up for all four webinars with one form to get the full picture
You will automatically receive recordings of any sessions you can't make. You'll be amazed how much value we can squeeze into 30 minutes.
DORA: the 4 domains to compliance
Anticipate, withstand, recover, evolve
Financial services firms generated 12% of the UK's economic output in 2023. DORA is an EU regulation that will make this critical sector more resilient to cyber attacks by reducing risk and improving governance.
The four domains of DORA that must be demonstrated and evidenced are:
● ICT risk management and governance● Your system for incident response and reporting● Your protocol for digital operational resilience testing● Your third-party risk management
Information sharing is recommended as well.
Breaches are inevitable, despite the layers of security adopted by most companies today. DORA is about cultivating your ability to anticipate, withstand, recover and evolve from a significant attack.
The Centre for Internet Security 18 Critical Security Controls
Complying with DORA can be significantly streamlined if you follow an established, recommended framework that guides your team in an efficient way to demonstrate and evidence your solutions that cover critical areas of data security.
The grid below represents the CIS Critical Security Controls with the three Implementation Groups below the grid. Compliance with the CIS Critical Controls also means you could reduce your cyber insurance premiums and enable you to streamline compliance efforts with PCI DSS, NIST CSF and other industry regulations.
Are your service providers DORA compliant?
Third party security
Adopt a stance of zero trust and zero assumption when it comes to managing the security of your supply chain
Under DORA, you will be expected to scrutinise the security measures of any supplier who might access your data or infrastructure. As attackers target upstream activities, the potential for multiplying damages escalates dramatically. Instead of targeting a single company, they can compromise entire networks of businesses that operate in tandem.
Checking credentials such as ISO 27001, ISO 9001 and Cyber Essentials Plus is always a good place to start.
The National Cyber Security Centre (NCSC), in partnership with the Centre for the Protection of National Infrastructure (CPNI), stress the importance of dynamic, proactive strategies. Their latest set of guidelines in 2021 further refines the defences organisations must build to protect not only their own interests but those of their suppliers and partners. These are categorised into four essential stages:
1. Risk Assessment and Protection Prioritisation
Begin by developing an exhaustive understanding of your supply chain. Evaluate the sensitivity of your operations and data access points to establish who your direct and indirect suppliers are, along with assessing their security postures.
The necessity for tight security measures becomes apparent in ensuring that suppliers uphold standards compatible with yours. Documentation of these aspects forms the backbone of creating risk profiles and defining stringent data protection standards expected from all parties involved.2. Establishing Control, Facilitating Communication, and Offering Support
With a comprehensive perspective of the supply chain's structure, pinpoint potential vulnerabilities and direct your efforts on mitigating these weak points. Frequent evaluations reveal patterns and dependencies that may necessitate diversification of your supplier base to reduce concentrated risks.
Communication about your security expectations and the repercussions of non-compliance must be clear to every supplier. Leading by example, foster a culture that underscores the significance of security and facilitate mechanisms for managing and mitigating incidents.3: Validation and Assurance
Confidence in your strategies is mandatory, and so is their validation. Effective contract management ensures that security clauses, like those requiring Cyber Essentials Plus or ISO 27001 certification, are always current and relevant.
Watch for extended, unchecked contracts, which can become obsolete as security paradigms shift. Introduce clauses like the right to audit, encouraging mutual compliance and regular revisions among your partners.4: Continuous Improvement and Adaptation
As the business environment and potential threats evolve, so should your strategies and those of your partners. Promote an environment where continuous improvement is both encouraged and supported, aligning with strategic goals which enhance competitive prowess and ensure resilience.
Solidifying supply chain security is a collective responsibility. It involves creating synergetic partnerships based on shared values and continuous dialogue, ensuring all nodes within the chain are robust enough to withstand and adapt to the challenges posed by modern cybersecurity threats.
Want to know more? Let's talk