The Cisco chief privacy officer told CNBC that he thinks there is alignment when it comes to the principles and the spirit of the law. However, he added, “any legislation is a product of compromise and so, as they get more prescriptive, then it becomes challenging.”<\/p>\n

“The principles we agree with, but any legislation is a product of compromise, and so as as they get more prescriptive, then it becomes challenging.”<\/p>\n

Still, despite the challenges, the broad expectation among experts is that it won’t be long until banks and other financial institutions achieve compliance.<\/p>\n

“Banks in Europe already comply with significant regulations which cover the majority of the areas that fall under DORA,” Fabio Colombo, EMEA financial services security lead at Accenture, told CNBC.<\/p>\n

“As a result, financial services institutions already have mature governance and compliance capabilities in place, with existing incident reporting processes and solid ICT risk frameworks.”<\/p>\n<\/div>\n

Risks for IT suppliers<\/h2>\n
\n
IT providers can also be fined under DORA. The rules threaten levies of as much as 1% of average daily worldwide revenue for up to six months.<\/p>\n
“These sanctions are necessary,” Brian Fox, chief technology officer of software supply chain management firm Sonatype, told CNBC. “They are a powerful motivator, pushing leaders to take compliance and operational resilience more seriously than ever.”<\/p>\n
Orange Cyberdefense’s Lindsay said there’s a risk longer term that financial services firms end up moving their critical security functions and services in-house.<\/p>\n
“Advances in technology may allow financial institutions to move services back in-house, simplifying this aspect and reducing the risk of non-compliance,” he said.<\/p>\n
“Either way, existing contracts will need to be updated to ensure compliance is contractually mandated and monitored between entity and provider,” Lindsay added.<\/p>\n
Meanwhile, there are several other cybersecurity-focused regulations that organizations will have to come to terms, such as the Network and Information Security Directive 2, or NIS 2<\/a>, and the Cyber Resilient Act. The former entered into force in October<\/a>.<\/p>\n
“As with any new regulation, there will certainly be a transitionary period as organisations adjust to new requirements and standards,” Sonatype’s Fox told CNBC. “This is the start of a long journey toward improving software security and resilience.”<\/p>\n<\/div>\n
\n
\n