EU Financial Entities Face Operational Scrutiny in Second Year of DORA

The Digital Operational Resilience Act (DORA) has entered its second year of enforcement across the European Union, marking a transition from administrative preparation to operational scrutiny. While the first year focused on establishing risk governance, updating third-party contracts, and documenting escalation workflows, the current phase demands that financial entities prove their practical ability to detect and respond to ICT-related incidents.

Regulators are expected to increase their focus on the effectiveness of ICT risk supervision and the accuracy of incident analysis. For security operations centres (SOCs), this shift raises critical questions regarding whether existing monitoring frameworks provide sufficient visibility to identify and scope active intrusions across complex environments.

The Shift to Continuous Monitoring

Under Article 9 of the Digital Operational Resilience Act, financial entities are required to continuously monitor and manage the security and functioning of their ICT ecosystems. While most organisations have established asset inventories and configuration records, visibility gaps often persist in legacy infrastructure, unmanaged devices, and specialised appliances where endpoint telemetry may be limited.

To satisfy the requirements of Article 10, which mandates the swift detection of anomalous activities, security teams must be able to recognise when operational patterns diverge from established baselines. Relying exclusively on endpoint detection and response (EDR) or identity logs can be insufficient; network-level telemetry is often necessary to provide the context required to identify lateral movement, reconnaissance, and command-and-control traffic that might otherwise bypass siloed security tools.

Strict Incident Reporting Timelines

Operational visibility is also a prerequisite for meeting the stringent reporting requirements outlined in Article 19. When a major ICT-related incident is classified, the initial notification must be submitted as early as possible, with a maximum window of four hours after classification and no later than 24 hours after the organisation becomes aware of the incident.

Rapid access to forensic evidence is essential for responders to establish the scope and impact of an attack within these narrow windows. The ability to trace affected systems and isolate rogue connections determines whether an organisation can meet its regulatory disclosure obligations.

Verifying Third-Party ICT Risk

The second year of DORA also emphasises the management of third-party ICT risk, as governed by Articles 28 through 30. While contractual agreements and vendor assessments define the authorized boundaries of a service provider on paper, network-level data provides the means to verify actual behaviour inside the IT environment.

By monitoring connection timing, protocol use, and data volume, organisations can determine if a trusted vendor’s software or API integrations are adhering to approved data paths. This visibility is critical for detecting scenarios where a provider’s credentials may have been compromised, causing their activity to deviate from documented operational expectations.