DORA Communications and Publications

Update on Registers of Information

6 December 2024

Collection of Registers of Information: Financial Entities are required to submit their Registers of Information, to the Central Bank of Ireland by Close of Business Friday, 4 April 2025. The Registers of Information should contain information as at 31 March 2025. Further information on how to submit Registers of Information, through the CBI Portal, will be provided in Q1 2025.

ESA workshop: Please also be aware that the ESAs have announced their final Registers workshop, taking place on 18 December 2024. Included in the announcement, at the link below, is further information on how to register by 16 December. Please ensure you register for this workshop to hear the most current advice coming from the ESAs following the completion of the dry run.

ESAs statement on DORA application: The ESAs released a general, high-level statement on the applicability of DORA for Financial Entities and potential Critical ICT Third Party service Providers (CTPPs).

Update on Threat-Led Penetration Testing (TLPT)

6 December 2024 

In respect of advanced Threat-Led Penetration Testing (TLPT), the Central Bank will engage directly with in-scope firms in the coming weeks. 

Please note this will only apply on a mandatory basis to a limited number of firms that meet the criteria under DORA.

For TLPT specific queries, please contact [email protected].

DORA Industry Briefing

8 November 2024

On 6 November 2024, Gerry Cross, Director of Financial Regulation - Policy and Risk at the Central Bank of Ireland hosted an industry briefing focused on the Digital Operational Resilience Act (DORA), which will become applicable from 17 January 2025. 

• Opening remarks by Gerry Cross
• An overview of the key pillars of DORA, ICT risk management & ICT third-party risk management, and Major Incident & Cyber Threat Reporting requirements (PDF 1.79MB)
• Re-watch Industry Briefing including Q&A here  

The Central Bank will in due course update this webpage with a FAQs document. This should be read in conjunction with the recording of the Q&A panel for further clarity on questions raised.

Registers Dry Run Submissions

24 July 2024

For firms participating in the voluntary exercise for the collection of DORA Registers of Information, please note that Registers should be returned to your point of contact in the Central Bank of Ireland by Friday 23 August 2024 at midday. This is to allow time for sense checks and follow up prior to the Central Bank of Ireland submission to the European Banking Authority during the week ending 30 August 2024.

The European Supervisory Authorities have published an updated FAQ on the exercise which can be accessed at the dry run exercise site.

Expectation of Firms’ Preparations for DORA 

17 June 2024

The DORA technical standards (RTSs and ITSs) will apply along with DORA from 17 January 2025. At this current time, all firms should have a good understanding of the requirements set out in DORA and the supporting RTSs/ITSs that are available. Gap analysis to firms’ existing frameworks, policies and processes should be substantially complete. This analysis should inform the steps to be taken to achieve DORA compliance by January 2025.

ESAs exercise for ad hoc collection of DORA Registers of Information (RoI) 

20 May 2024

The Digital Operational Resilience Act (DORA) applies to a wide range of financial entities regulated by the Central Bank of Ireland (CBI). Under DORA financial entities are required to maintain and update their Register of Information (RoI) in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers. 

The European Supervisory Authorities (ESA) have introduced a voluntary exercise to help financial entities establishing their RoI, based on information specified in the ESAs’ final draft Implementing Standards on the registers of information in order to test reporting their RoI in a manner similar to that foreseen from January 2025 onwards.

This dry run RoI collection (which will run from July to August 2024) is a voluntary exercise, on a best effort basis, and although the CBI will be reaching out to a sample of firms to request their participation in this exercise, it is open to all financial entities which will be subject to DORA. 

The ESAs held a workshop for industry on this on 30 April 2024. A recording of this workshop and the slides are now available. These provide clarity of the intention and mechanism of the dry run exercise and indicates the expectation of the ESAs with regards to a formal collection of the complete registers starting from early 2025. 

If your firm wishes to volunteer and participate in this exercise, please contact your normal supervisory point of contact in the CBI before Wednesday 29th May 2024.