DORA six months on: How has it affected the channel?

Half a year after the EU’s cybersecurity regulation was introduced, CRN speaks to partner firms to hear what the impact has been

The six-month mark since the European Union’s Digital Operational Resilience Act (DORA) was rolled out has passed, and financial organisations are still falling short on their data resilience measures.

The aim of the regulation is to improve cybersecurity in financial services (FS) across EMEA.

But according to a new study by Veeam Software, a whopping 96 per cent of EMEA FS organisations believe they still need to improve their resilience to meet DORA requirements.

This raises further questions around DORA’s impact on the channel partners helping these FS organisations.

To find out more, CRN canvassed several partner firms about their experience so far.

Rob Young, CEO, Infinity Group

How has DORA impacted your business so far?

DORA has had a profound impact on our business, both operationally and strategically. As a partner serving financial institutions, we’ve had to elevate our internal governance, risk management and service delivery frameworks to align with DORA’s stringent requirements.

This has meant re-evaluating our own ICT risk posture, enhancing incident response protocols and ensuring our services meet the resilience standards expected of critical third-party providers.

Has DORA opened new revenue streams or service opportunities for your business?

DORA has increased demand for specialised compliance support, creating new service opportunities across consulting, managed security and resilience testing. Financial institutions are under pressure to meet the requirements around ICT risk management, incident reporting and third-party oversight. However, many lack the in-house expertise or resources to do so effectively, so are relying more on external partners like Infinity Group.

In essence, DORA has transformed compliance from a cost centre into a growth opportunity, allowing us to deliver high-value services that directly support our clients’ regulatory and operational goals.

How has DORA reshaped cyber resilience across financial services so far?

DORA has embedded cyber resilience into the core of operational strategy. It’s no longer sufficient to have reactive security measures: institutions must now demonstrate the ability to withstand and adapt to cyber threats. We’ve seen financial institutions move toward continuous monitoring, threat-led penetration testing and more rigorous third-party risk assessments. The regulation has also elevated the role of the CISO, making cybersecurity a board-level concern.

Has DORA genuinely improved FS sector preparedness for cyberattacks?

DORA has undoubtedly raised the bar for preparedness by mandating structured risk management, incident response, and resilience testing. Financial institutions are now more aware of their vulnerabilities and are taking steps to address them.

However, preparedness varies widely across the sector. Smaller firms are still grappling with the complexity and cost of compliance. While DORA has shifted the focus, it’s up to institutions to take the right steps, which is an ongoing process.

Has it fallen short anywhere?

DORA’s implementation has exposed some shortcomings. Chief among them is the complexity of compliance, especially for smaller firms. The regulation’s broad scope and detailed requirements, such as maintaining ICT service registers and conducting resilience testing, can be overwhelming without dedicated resources. This is on top of GDPR adherence, which can complicate things further.

How are your financial services clients responding to DORA?

We’ve seen a marked increase in client engagement around DORA, with many requesting advisory services. The regulation has elevated cybersecurity to a strategic priority, and clients are responding with urgency and openness to collaboration. This is particularly true for smaller firms who face resource constraints so need support to make the right moves.

Continue reading to hear insights from Bytes and Advania UK…

Jack Watson, MD, Bytes

How has DORA impacted your business so far?

Positively. Bytes is always seeking new ways to demonstrate to customers our deep knowledge of the challenges that they face and how we can assist them with the most appropriate means of meeting their challenges. While Bytes does not operate services that require us to be DORA compliant, we have complied with NIS2 requirements which places a similar level of operational resilience requirements upon us for providing services within the EU. Additionally, it has allowed us to have open conversations with financial sector clients around a greater number of areas including data management, third party management, cost rationalisation and technical debt.

Has DORA opened new revenue streams or service opportunities for your business?

It has allowed us to deepen our engagement and explore conversations around third-party risk, data management, and technical debt. This opens doors to more advisory and managed services opportunities for us.

How has DORA reshaped cyber resilience across financial services so far?

This is an interesting question, because in the UK, the Bank of England already operates on requirements for operational resilience within the financial sector. This covers many of the requirements that are within DORA, therefore, large UK firms should have an advantage against these regulations.

In the EU this is providing some more interesting challenges as these requirements are still bedding in, and resilience is a long-term strategic objective that takes time to measure effectively. It is likely that any real advantages and change will be borne out over the longer term and will be reflected in reduced outages and the number of compromises that occur.

In the longer-term endeavouring to level the playing field and improve operational resilience is the right thing to do, it is yet to be seen if this legislation will actually achieve it. I am hopeful that it will but suspect that its value will likely be eroded over time as occurs with most regulations in the cyber space - as even outcome-based requirements (like DORA) without strong enforcement or post market surveillance become diluted.

Has DORA genuinely improved FS sector preparedness for cyberattacks?

While a lot of the regulations are paperwork-based there are aspects of the requirements that are likely to improve preparedness. This relates to the area of Threat Led Penetration Testing (TLPT). This is interesting, as the Bank of England along with the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) brought in this type of testing using CREST CBEST back in 2014.

While not all firms undergo CBEST testing, CREST has other options like STAR and STAR-FS which allows for intelligence led penetration test using simulated cyber attacks based on current threats, using realistic threat actor behaviour, and any gained intelligence that enables these. Moreover, this also allows the firm tested to evaluate their capabilities to detect and respond to real world assault, both externally and internally. Testing in this manner allows for the firms to understand real world risk in their attack surfaces, but also how they might respond if it does happen. There is no substitute for real world evaluation and testing of your capabilities to improve your preparedness and approach to cyber attack. This is the area that is likely to make the most difference.

Has it fallen short anywhere?

Several people have spoken on this subject already and to summarise some of the areas that it is believed to have fallen short:

• It may set a perverse incentive for executives that seek to meet the regulations to dispatch their obligations rather than consider cybersecurity in its wider context against more mature and established frameworks of industry accepted good practice.
• The regulations focus on prevention but it is equally important to consider reactive controls as well as recovery approaches if successful attacks do occur.
• There is little consideration for human error or insider risks.
• The larger entities have had a major advantage that they were in highly regulated sectors (banks and hyperscalers) and only had smaller adaptations to make to comply, whereas a lot of the smaller firms had to make more wide ranging changes and have disproportionately affected them.
• Not all of the approach was clarified by the regulators before DORA came into effect. For instance the Delegated Regulations on subcontracting, as well as the guidance on DORA oversight of critical IT providers have only just been published - this makes it harder for companies to hit a moving target even though they should already be compliant.

Gaining compliance against a moving target without all of the guidance or enforcement approaches being published means that what companies have already implemented could be wrong, and cost money to correct. This makes it more difficult and time consuming as well as disproportionately impacting the smaller regulated firms. This is usually the area that falls short - companies need more clarity and guidance as well as how and why enforcement actions will occur. This provides certainty around investment and that approach will meet requirements.

What specific pain points or concerns are customers raising?

The main pain points that we see customers raising are in the following areas:

• Complexity of the implementation, based on overlapping rules and conflicting requirements caused by jurisdictional requirements if based outside of the EU but still caught by the regulations through European operations.
• Identifying relevant in-scope ICT suppliers, and then more broadly managing their supply chains, where complex relationships between vendors and subcontractors exist meaning that digging into the length and interconnectivity becomes very challenging. This is then further compounded when they try to enforce security standards down those supply chains, and the further you get away from your directly contracted entities into the nth parties - this becomes even less enforceable as you have no direct relationships.
• Incident reporting that might need to be within four hours and no later than 24 hours for initial reports, and within 72 hours for intermediate reports is challenging where suppliers have longer timeframes for initial reporting that could be as long as 72 hours is triggering contract changes that are difficult and costly to negotiate.
• There is technical debt and legacy deployments coupled with complex digital environments that makes implementation, maintenance and monitoring difficult to achieve.

With any new requirements there are always challenges. In some cases, the newer the infrastructure, the simpler the problem becomes, but usually the less maturity of operation exists than those environments that have been operated over many years. So there is a balancing act, and all of this rests on DORAs approach to risk management, and using these techniques to the firm's advantage to prioritise how they can achieve operational resilience and when. They are not on their own, working groups, specialist advice and channel organisations like Bytes can all help with these pain points.

Raghbir Basra, senior information security consultant, Advania UK

How has DORA impacted your business so far?

We saw the biggest spike in activity in Q4 2024, as the deadline approached. It wasn’t exactly a panic, but there was definitely urgency. Some clients wanted a gap analysis against what they’d already done, while others came to us to design new processes at the eleventh hour. Since then, activity has tapered off.

Has DORA opened new revenue streams or service opportunities for your business?

Not significantly. The regulation drove short-term project work, but no sustained new service lines that we can directly attribute to DORA. If anything, the recent Scattered Spider incidents have had a bigger impact on how organisations think about resilience - but this could be recency bias impacting my view. From what we’ve seen, many treated DORA as a one-off compliance project rather than an ongoing resilience programme (which is wrong - it is ongoing work).

How has DORA reshaped cyber resilience across financial services so far?

Some firms used DORA as an opportunity to strengthen governance, testing, and supplier oversight, but others approached it as a compliance checklist rather than a catalyst for lasting change. In some cases, resilience planning has improved on paper, but operational practices and regular testing haven’t kept pace.

Has DORA genuinely improved FS sector preparedness for cyberattacks?

It has prompted more documented plans and clearer accountability, but whether that translates into faster, more effective response to real-world incidents is still an open question. A lot will depend on whether organisations maintain momentum now that the initial compliance push is over.

Has it fallen short anywhere?

Yes, proportionality has been a sticking point, particularly for smaller firms. Some have struggled to interpret requirements in a way that’s achievable without overextending resources. More broadly, the regulation’s impact has been front-loaded; without sustained testing and review cycles, there’s a risk that resilience measures will stagnate.

Are clients proactively asking about how you support their DORA compliance?

Right now, no. Most of our conversations about resilience are triggered by emerging threats or incidents (M&S, Co-op) rather than the regulation itself. Scattered Spider and other high-profile attacks have done more to reignite discussions than DORA follow-up has.