Results of the DORA readiness survey conducted in September 2024

Published on 7 October 2024 Email this Share this on LinkedIn Share this on Facebook Communiqué Results of the DORA readiness survey conducted in September 2024 The CSSF launched in August 2024 a DORA readiness survey to nearly 500 entities which will fall under the DORA regulation, applicable as from 17 January

1. The objectives of the survey were twofold: Primarily, to assess the level of readiness as of 1 September by financial entities towards DORA, and capture the main challenges encountered by financial entities. Secondarily, to raise once more the awareness to those financial entities that are late in getting ready. The survey consisted of a limited number of 10 closed questions around the following topics: GAP analysis and perceived readiness Top challenges encountered With 90% of respondents having completed their DORA gap analysis, and despite the challenges encountered, the survey shows encouraging progress by financial entities in their DORA compliance work. With more than four months to go before DORA applies, the financial place is still in a preparatory phase. More than two thirds of entities consider themselves to be partially ready, while almost a quarter of entities consider themselves to be almost ready. The detailed results of this survey have now been published on the CSSF website. 7 October 2024 Results of the DORA readiness survey Communiqué of 7 October 2024: Results of the DORA readiness survey conducted in September 2024 Studies and reports PDF (908.88Kb) Main topic: ICT and cyber risk – for DORA entities Relevant for Central Securities Depositories (CSDs) Credit institutions Crowdfunding service providers Data Reporting Service Providers (DRSPs) E-money institutions Investment firms Investment fund managers Payment institutions Results of DORA readiness survey 1 October 2024 DORA Readiness Survey The CSSF launched a survey to allow it to gain a better view of the readiness of the market towards the end of the implementation timeline for DORA, which becomes applicable on 17 January
2. Objectives of the survey: Primarily to assess the level of readiness as of September 1st, (so four and a half months before DORA application date) by financial entities towards DORA, and capture the main challenges encountered by financial entities. Secondary to raise once more the awareness to those financial entities that are late in getting ready. Answers accepted between September 2nd and September 16th Participation was not mandatory but was strongly recommended 1 October 2024 2 Very good level of participation 389 answers out of 494 contacted entities => almost 80% 1 October 2024 3 1 Part 1: GAP analysis & perceived readiness 4 GAP analysis carried out – all entity types cumulated ICT Risk Management ICT-related incident management, classification and reporting Digital operational resilience testing ICT third-party risk management Nearly 90% of entities have carried out a gap analysis between their situation and DORA requirements. Entities that have carried out a gap analysis have generally addressed all four topics. Just over 10% of entities are very late and should work on their gap analysis and action plan immediately! Overall, strong progression in gap analysis realized compared to results from previous surveys (e.g. ABBL or PwC surveys done between March and June on a sample of entities) 1 October 2024 5 GAP analysis carried out - per entity type Credit institutions are the most advanced, with >97% having carried out a GAP analysis, followed by AIFM and ManCo with nearly 90% Investment Firms, PI and EMI are between 74% and 84% 1 October 2024 6 Overall perceived readiness level The overall perceived readiness score is 2.8, (1 being fully ready, 4 being not ready) => As expected, the market is still in a preparatory phase but progressing well 71% of the entities perceive themselves as partially ready and is homogenous among entity types 23% of the entities perceive themselves as mostly ready and is homogenous among entity types 6% of the entities perceive themselves as not ready 1 entity perceives itself as fully ready 1 October 2024 7 Overall perceived readiness level - per DORA topics ICT Risk Management ICT-related incident management, classification and reporting Digital operational resilience testing ICT third-party risk management The scores of the topics are quite balanced, except on Incident management, which is slightly better (2.5). Presumably this is because the pre-existing setup on ICT incident management already in place is close to the DORA requirements. Between 30% (for ICT third-party risk management) and 53% (for ICT incident management) of the entities are fully or mostly ready. The others still have significant work ahead of them. 1 October 2024 8 Perceived readiness per entity type 07 October 2024 1 October 2024 All chapters included, there is no significant discrepancies between entity type’s readiness (scores are between 2.6 and 2.8) 9 2 Top challenges 10 Terminology The challenges proposed for selection were: o Understanding of DORA requirements o Shortage of resources (Technical, Human Resources, Budget) o Short delays to implement DORA requirements o Dependence on group resulting in coordination efforts (complexity and delays) o New governance set-up (board involvement, control functions, cultural change) o Defining and implementing your digital operational resilience strategy o Mapping of critical or important functions with information assets and ICT assets o Alignment of ICT related incident reporting processes and tooling o Contractual negotiations with ICT third party service providers o Unavailability of underlying information to complete the Register of Information 1 October 2024 11 Overall Top 3 most critical challenges The top challenges, all priorities included : Contractual negotiations with ICT third party service providers (54%) Dependence on group resulting in coordination efforts (complexity and delays) (42%) Shortage of resources (Technical, Human Resources, Budget) (40%) Short delays to implement DORA requirements (40%) “Shortage of resources (Technical, Human Resources, Budget)” is the most raised Priority 1, with nearly 1 entity out of 4 (23%) On the opposite, “Alignment of ICT related incident reporting processes and tooling” has only been raised by 12% of the entities (all priorities included), and only by 1% as priority 1 “Understanding of DORA requirements” was raised by 17% of the entities as Priority 1 and selected in top 3 by 23%, calling for even more exchanges with peers, professional associations, advisors and authorities (SSM/CSSF) 1 October 2024 12 Critical challenges – Focus on AIFM & ManCo Top 4 “Contractual negotiations with ICT third party service providers” is the top challenge and has been raised by 51% of the entities, followed by “Dependence on group” with 44% “Shortage of resources (Technical, Human Resources, Budget)” is the most raised Priority 1, with 20% (concern for 37% of the entities), followed by “Dependence on group” with 19% in Priority 1 (concern for 44% of the entities) In line with the entity average, “Understanding of DORA requirements” was also raised by 19% of the AIFM & ManCo entities as Priority 1, but is a concern for 24% of them 1 October 2024 13 Critical challenges – Focus on Credit institutions Top 4 “Contractual negotiations with ICT third party service providers” is the top challenge and has been raised by 66% of the entities, followed by “Dependence on group” with 49% “Shortage of resources (Technical, Human Resources, Budget)” is the most raised Priority 1, with 27% (concern for 39% of the entities), followed by “Short delays” with 26% in Priority 1 (concern for 44% of the entities) “Understanding of DORA requirements” is less of a concern than for other entities (Total 17%) 1 October 2024 14 Critical challenges – Focus on Investment Firms Top 4 “Contractual negotiations with ICT third party service providers” is the top challenge and has been raised by 53% of the entities, with 18% in priority 1 “Shortage of resources (Technical, Human Resources, Budget)” is the most raised Priority 1 with 21% and is a concern for 42% of the entities “Defining and implementing your digital operational resilience strategy” appears only in the EIs’ top 4, with 37% raised, but with only 7% in priority 1 In line with the entity average, “Understanding of DORA requirements” was raised by 19% of the entities as Priority 1, and is a concern for 28% of the Investment Firms 1 October 2024 15 Critical challenges – Focus on PI and EMI Top 4 “Shortage of resources (Technical, Human Resources, Budget)” is by far the most raised Priority 1, with 47% and is a concern for 63% of the entities “Dependence on group resulting in coordination efforts (complexity and delays)” is a concern for 58% of the entities, however, it is only considered as Priority 1 by 11% of the entities Unlike other entities, “Contractual negotiations with ICT third party service providers” is on 3rd rank, with 47% of the entities and only 5% in priority 1 “Understanding of DORA requirements” is less of a concern than for other entities, with a total of 16% and only 5% in Priority 1 1 October 2024 16