Cyber threats continue to evolve at an alarming pace, posing significant risks to financial institutions and service providers across the UK and Europe. While many UK firms may assume that the Digital Operational Resilience Act (DORA) – an EU regulation – does not directly apply to them post-Brexit, the reality is that its principles are becoming a de facto standard for operational resilience, especially in financial services.
DORA and its relevance to UK firms
DORA introduces harmonised digital resilience requirements across the EU. The regulation mandates that financial institutions and information and communications technology (ICT) service providers:
- Strengthen their cyber risk management frameworks
- Perform rigorous operational resilience testing
- Ensure robust third-party risk oversight
- Report major cyber incidents promptly
While this is an EU regulation, UK-based firms that operate in the EU, provide ICT services to EU financial institutions, or handle cross-border financial transactions may fall within its scope. However, even for those outside its direct jurisdiction, DORA’s best-practice approach aligns closely with existing UK regulatory expectations, such as those from:
- The Financial Conduct Authority (FCA) and its operational resilience framework
- The Prudential Regulation Authority (PRA) on ICT risk management
- The Bank of England (BoE) through the CBEST cyber resilience framework
- The UK National Cyber Security Centre (NCSC) best-practice guidance
As such, UK firms should not view DORA as an external requirement but as an opportunity to enhance their own cyber resilience strategies and align with global best practices.
The Role of Awareness and Training in DORA Compliance
A resilient organisation is one where employees – from the boardroom to the front line – understand the risks and know how to respond effectively
While DORA sets clear technical and regulatory expectations, compliance alone is not enough. A resilient organisation is one where employees – from the boardroom to the front line – understand the risks and know how to respond effectively. This is where cybersecurity training and awareness programmes play a vital role.
Key areas where training supports DORA compliance:
- Incident response preparedness
- DORA requires firms to detect, report, and respond to cyber incidents swiftly.
- Staff training ensures faster threat identification, containment, and reporting to minimise damage.
- Third-party risk management
- Employees need to understand supply chain cyber risks, particularly when managing ICT service providers.
- Training helps ensure compliance with contractual obligations and risk assessment procedures.
- Operational resilience drills & testing
- DORA mandates regular digital resilience testing to ensure firms can withstand cyber threats.
- Simulated cyber-attack training helps teams test their response strategies in real time.
- Regulatory & compliance awareness
- Staff must stay updated on DORA’s evolving requirements and how they align with UK regulations.
- Training helps ensure policies and practices remain compliant and auditable.
- Cultural shift towards cyber resilience
- A strong security culture is essential for operational resilience.
- Ongoing training creates a workforce that is proactive, security-conscious, and compliance-aware.
Preparing now: Aligning with DORA’s best practices
To remain competitive and resilient, UK firms should take proactive steps now:
✔ Integrate DORA-aligned cyber resilience principles into existing Operational Resilience frameworks.
✔ Conduct gap analyses to assess readiness against DORA’s expectations.
✔ Implement structured cybersecurity training to empower employees at all levels.
✔ Engage with regulatory guidance from the FCA, PRA, and NCSC to ensure alignment with UK requirements.
Conclusion: DORA is an opportunity, not just a regulation
DORA may be an EU directive, but its principles reflect a global shift towards stronger digital operational resilience. For UK firms, aligning with its framework isn’t just about compliance – it’s about future-proofing their operations, protecting customers, and staying ahead of cyber threats.
By prioritising awareness, training, and proactive compliance, businesses can build a cyber-resilient culture that mitigates risk and maintains trust in an increasingly regulated digital landscape.
