Article 40 Digital Operational Resilience Act (DORA), Information-Sharing Arrangements On Cyber Threat Information And Intelligence

Article 40 of the Digital Operational Resilience Act (DORA) establishes guidelines for financial entities to exchange cyber threat information and intelligence. This article is pivotal in fostering a collaborative approach to cybersecurity within the financial sector, enhancing the collective digital operational resilience of financial entities.

Exchange of Cyber Threat Information

Financial entities are permitted to exchange cyber threat information and intelligence, including:

• Indicators of Compromise (IoCs): Specific signs that may indicate a cyber attack or breach.

• Tactics, Techniques, and Procedures (TTPs): Methods used by threat actors during cyber attacks.

• Cybersecurity Alerts: Notifications about emerging threats or vulnerabilities.

• Configuration Tools: Tools and settings designed to enhance cybersecurity defenses.

The objective of this exchange is to improve the digital operational resilience of financial entities by:

• Raising Awareness: Enhancing understanding of cyber threats and their potential impact.

• Limiting Threat Spread: Implementing measures to prevent the further proliferation of cyber threats.

• Supporting Defensive Capabilities: Bolstering the entities' defensive strategies, threat detection techniques, and mitigation efforts.

• Enhancing Response and Recovery: Improving response strategies and recovery processes following cyber incidents.

To ensure the effectiveness and security of these exchanges, the sharing of information must occur within trusted communities of financial entities. These arrangements are designed to protect the sensitive nature of the information shared and are governed by strict rules of conduct. This governance ensures that the sharing process respects:

• Business Confidentiality: Maintaining the confidentiality of business operations and proprietary information.

• Protection of Personal Data: Safeguarding personal data in compliance with data protection regulations.

• Competition Policy Guidelines: Adhering to guidelines that prevent anti-competitive practices.

Information-Sharing Arrangements

The information-sharing arrangements must be clearly defined and regulated to ensure effective participation and operational security. These arrangements should outline:

• Conditions for Participation: Specific requirements and conditions that financial entities must meet to participate in the information-sharing arrangement.

• Involvement of Public Authorities: If applicable, details on how public authorities may be involved in the information-sharing process, including their role and capacity.

• Operational Elements: Practical aspects of the arrangement, including the use of dedicated IT platforms for secure information exchange.

These operational details ensure that the sharing process is efficient, secure, and compliant with relevant regulations and standards.

Notification Requirements

Financial entities are required to inform competent authorities about their involvement in information-sharing arrangements. This includes:

• Notification of Participation: Informing competent authorities once their participation in an information-sharing arrangement is validated.

• Notification of Cessation: Reporting to competent authorities when their participation in the arrangement ceases, effective from the date of cessation.

This notification process helps maintain transparency and allows competent authorities to monitor and oversee the participation of financial entities in these critical information-sharing arrangements.

Conclusion

Article 40 of DORA outlines a framework for the exchange of cyber threat information among financial entities, emphasizing the importance of collaboration in enhancing digital operational resilience. By setting standards for information-sharing arrangements, the article aims to bolster collective cybersecurity defenses while protecting sensitive information and maintaining regulatory compliance. The structured approach to participation, operational details, and notification requirements ensures that the exchange of cyber threat intelligence is conducted effectively and securely, contributing to a more resilient financial sector.