Insights on DORA's Second Batch of RTS / ITS

Introduction to DORA's Latest Publication

The European Supervisory Authorities (ESAs), comprising the EBA, EIOPA, and ESMA, have recently released the second batch of Level 2 text (RTS / ITS) under the Digital Operational Resilience Act (DORA) on July 17, 2024. This follows the release of the first batch on January 17, 2024, marking another significant step towards enhancing the digital operational resilience within the EU's financial sector, in line with the regulatory obligations under Regulation (EU) 2022/2554.

Key Components of the Second Batch

This latest package includes:

• RTS on the harmonisation of conditions enabling the conduct of the oversight activities; and

• RTS specifying the criteria for determining the composition of the joint examination team (JET); and

• RTS on threat-led penetration testing (TLPT); and

• RTS and ITS on the content, format, templates and timelines for reporting major ICT-related incidents and significant cyber threats.

• Guidelines on the estimation of aggregated costs/losses caused by major ICT-related incidents; and

• Guidelines on oversight cooperation.

Anticipated Developments and Compliance Timeline

The ESAs have submitted the final draft technical standards to the European Commission for review, with the aim of adopting these policy products in the coming months.

However, the anticipated additional RTS on subcontracting ICT services supporting critical or important functions have yet to be released, with the ESAs indicating that the "remaining RTS on Subcontracting will be published in due course."

Simmons & Simmons: Your Guide Through DORA Compliance

Simmons & Simmons remains at the forefront, offering expert guidance to navigate the evolving regulatory landscape under DORA. Our team is dedicated to assisting clients in understanding and implementing the necessary measures to comply with these new requirements, ensuring their operations are resilient against the backdrop of digital operational challenges. The application of DORA, along with its associated EU policy products, will commence from January 17, 2025, marking a new era of digital operational resilience in the financial sector.

This publication of the second batch of policy products will aid financial entities in smoothing the process to become DORA compliant before the fast-approaching deadline.