DORA requires the implementation and operation of 5 pillars for financial institutions in order to be in compliance:

Pillar 1 ICT Risk Management

• Financial entities must implement a comprehensive ICT risk management framework covering governance, policies, roles and responsibilities, and the full risk lifecycle (identify, protect, detect, respond, recover) to proactively manage digital risks. 

Pillar 2 ICT‑related Incident Management, Classification & Reporting

• Firms must establish processes to detect, classify by severity, and report major ICT‑related incidents to their competent authority within strict deadlines, using harmonised templates and channels to ensure transparency. 

Pillar 3 Digital Operational Resilience Testing

• Organisations are required to perform regular resilience tests—such as vulnerability assessments, scenario‑based tabletop exercises and threat‑led penetration testing—and to remediate any gaps identified to validate their ability to withstand cyber‑attacks. 

Pillar 4 Management of ICT Third‑Party Risk

• Entities must conduct due diligence, embed mandatory contractual clauses, and continuously monitor critical ICT service providers (including cloud and outsourcing partners) to ensure they meet the same security and resilience standards. 

Pillar 5 Information‑Sharing Arrangements

• DORA encourages voluntary, secure sharing of cyber threat intelligence and best practices among financial firms and authorities to foster collective situational awareness and strengthen the EU financial ecosystem’s overall resilience.

NIS2 is a self electing directive, however, has requirements that are similar to that of DORA. In Luxembourg, this directive is overseen by the Institute Luxembourgeois de Régulation (ILR). The requirements are below:

Self-Regulation

• Firms must declare its designation as per self assessment to national competent authorities.

Cybersecurity Risk Management

Entities will want to implement a cohesive cyber security risk management framework including:

• Risk analysis and information system security
• Assess the effectiveness of cybersecurity risk-management measures. 
• Business continuity, disaster recovery and crisis management
• Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure
• Human resources security, access control policies and asset management

Incident Notification

• Companies should report security incidents promptly and as such, should have processes for this purpose.

Security in Supply Chain

• In-scope organisations must consider the vulnerabilities to each direct supplier and service provider.

Training and Awareness

• Training programs should be implemented to ensure proper cyber hygiene practices.

The Network and Information Security (NIS) Directive and the Digital Operational Resilience Act (DORA) are regulatory measures aimed at enhancing the digital resilience of the European Union (EU) and mitigating the impact of cyber incidents. To ensure a harmonious implementation, the European Commission has issued Guidelines clarifying the exemption of entities to which sector-specific legal acts apply from the NIS2 Directive. These Guidelines explicitly state that DORA has priority over NIS2 provisions on ICT risk management, cyber incident reporting, digital operational resilience testing, information-sharing, ICT third-party risk, supervision, and enforcement.

DORA incorporates a provision known as "lex specialis," granting it priority over the NIS2 Directive, which is considered a general law. This provision ensures that if there are any conflicts or overlaps between the two directives, DORA takes precedence. The "lex specialis" provision in DORA helps to avoid confusion and ambiguity in the regulatory landscape.

This clarification provides additional clarity on the exemption of the banking sector from the NIS2 Directive. Financial entities covered by DORA should adhere to its provisions instead of those outlined in the NIS2 Directive.

DORA: Digital Operation Resilience Act

• DORA introduces clear and well-defined guidelines, offering the above regulated entities an opportunity to showcase their digital maturity. While some sectors, like banking, will primarily focus on updating existing measures, others, such as Investment Management, face more intensive implementation efforts. 
  • BDO will support you through a readiness assessment that is crucial, guiding entities in tailoring action plans for compliance.
  • While a readiness assessment is crucial, we support you by implementing a robust framework that addresses any potentially identified gaps

PSD2: Payment Services Directive

• At BDO, we specialize in providing comprehensive PSD2 compliance solutions tailored to meet the unique needs of our clients. Our team of experienced consultants possesses in-depth knowledge of the regulatory landscape and the technical expertise required to ensure a smooth implementation process. Here's how we can assist you:
  • Regulatory Guidance: We stay up-to-date with the latest PSD2 requirements and can provide you with clear and practical guidance on how to align your business operations with the regulation. Our experts will help you understand the specific obligations, such as strong customer authentication (SCA), secure communication channels, and access to account information, ensuring you remain compliant at all times.
  • Security and Risk Management: PSD2 introduces significant security and risk management considerations. We can conduct comprehensive risk assessments, identify vulnerabilities, and develop tailored security strategies to mitigate potential threats. Our goal is to help you build a secure environment that safeguards your customers' data and protects your business from unauthorized access or fraudulent activities.
  • Ongoing Compliance Support: PSD2 compliance is not a one-time effort; it requires continuous monitoring and adaptation to evolving regulatory demands. Our team provides ongoing compliance support, keeping you informed about any changes in the regulatory landscape and assisting you in maintaining a compliant and competitive position within the market.

Gap assessment & Roadmap

• Our dedicated team of auditors and advisors provide the independent assurance your management needs on DORA compliance from the third line of defense. 
• As a stand-alone advisory audit or as part of the recurring internal audit plan, ask your BDO contact about how we include DORA in our audits!

Implementation Support

• Our BDO advisors have hands-on experience with DORA templates including the register of information (ROI), ICT risk management framework, ICT risk register, third party risk management policy and procedures, operational resilience testing programs, and more.

External Verification & Auditing

• Our dedicated team of auditors and advisors provide the independent assurance your management needs on DORA compliance from the third line of defense.