DORA

The scope of obligations to ensure information and cyber security will not change that much with the new law. What will be new, however, will be the number of regulated entities. Under the current cyber security law regime, obligations are imposed on several hundred larger firms and public bodies. The new law will affect thousands, if not tens of thousands, of organizations. Including a number of medium and smaller entities. Even in areas that have not yet been covered by any regulation directly related to information or cyber security, such as the food industry, waste management, the provision of certain IT services, transport, etc.

Already on December 27, 2022, the new Regulation of the European Parliament and of the Council (EU) 2022/2554 of December 14, 2022 on the digital operational resilience of the financial sector and on the amendment of other regulations, abbreviated as DORA (Digital Operational Resilience Act), was published in the Official Journal i.e. Digital Operational Resilience Regulation). It should be applicable (ie effective) from 17 January 2025.