Article 30 Digital Operational Resilience Act (DORA), Tasks of The Lead Overseer

Article 30 of the Digital Operational Resilience Act (DORA) outlines the responsibilities of the Lead Overseer regarding critical ICT third-party service providers. The Lead Overseer plays a crucial role in ensuring that these providers adhere to rigorous standards to safeguard the stability and security of financial services.

Assessment Responsibilities

The Lead Overseer is tasked with evaluating whether each critical ICT third-party service provider has established comprehensive and effective measures to manage the ICT risks associated with their services. This assessment involves several key areas:

• ICT Requirements: The Lead Overseer must assess whether the provider’s ICT systems meet essential criteria, including security, availability, continuity, scalability, and quality of services. This evaluation ensures that the provider maintains high standards of data security, confidentiality, and integrity.

• Physical Security: The assessment includes reviewing the physical security measures in place, such as the security of premises, facilities, and data centers, which contribute to the overall ICT security.

• Risk Management Processes: The Lead Overseer must examine the provider’s risk management processes. This includes assessing their ICT risk management policies, business continuity plans, and disaster recovery strategies to ensure they are robust and effective.

• Governance Arrangements: The governance structure of the ICT provider is scrutinized to ensure clear, transparent, and consistent lines of responsibility and accountability. This helps in managing ICT risks effectively and maintaining a well-organized oversight framework.

• Incident Management: The provider’s mechanisms for identifying, monitoring, and reporting ICT-related incidents, including cyber-attacks, are evaluated. The effectiveness of their incident management and resolution processes is critical to maintaining operational stability.

• Data and Application Portability: The Lead Overseer reviews the provider’s mechanisms for data portability, application portability, and interoperability. These mechanisms are essential for enabling financial entities to exercise their termination rights effectively and transition smoothly if needed.

• System Testing and Audits: The Lead Overseer assesses the provider’s testing of ICT systems, infrastructure, and controls. Additionally, the provider’s ICT audits are reviewed to ensure they adhere to relevant standards and practices.

• Compliance with Standards: The use of national and international standards relevant to the provision of ICT services is also evaluated. This ensures that the provider’s practices align with widely accepted standards and regulations.

Oversight Plan

Based on the assessment, the Lead Overseer develops a detailed and reasoned Oversight Plan for each critical ICT third-party service provider. This plan outlines specific oversight measures and is communicated to the provider annually. The plan is designed to ensure that the provider remains compliant with required standards and effectively manages ICT risks.

Coordination with Competent Authorities

Once the annual Oversight Plans are agreed upon and communicated to the critical ICT third-party service providers, competent authorities can only take action concerning these providers in alignment with the Lead Overseer’s plans. This coordination ensures a unified approach to oversight and intervention, preventing conflicting measures and ensuring that all actions are consistent with the established oversight framework.

By focusing on these comprehensive assessment and oversight responsibilities, the Lead Overseer helps ensure that critical ICT third-party service providers maintain high standards of ICT risk management. This contributes to the overall stability and resilience of the financial sector, protecting it from potential disruptions and security threats.