DORA y Essential Eight: Guía de cumplimiento de seguridad

What if the tools you rely on to protect your organization’s networks are only solving part of the problem? 

The Essential Eight has long been a trusted framework for securing IT systems. Still, as cyber threats grow more sophisticated, strategies that address resilience on a deeper, more dynamic level are needed. 

This is where the Digital Operational Resilience Act (DORA), a regulation tailored to the financial sector, comes in. It is designed to withstand operational disruptions and ensure continuity. 

Now, the question arises: can these two distinct approaches work together to create a seamless, fortified defense? 

Let’s explore how these frameworks intersect and the potential they hold when integrated.

¿Qué es DORA?

DORA, or the Digital Operational Resilience Act, is a regulation designed to protect networks and information systems across the EU’s financial sector. It’s a mandatory framework to ensure banks, insurance companies, investment firms, and similar entities remain secure and resilient, even during severe operational disruptions.

¿Por qué es tan crítico? 

If ICT (Information and Communication Technology) risks aren’t adequately managed, disruptions can ripple across borders, impacting financial services, businesses, entire sectors, and potentially the broader economy. 

DORA exists to strengthen the financial sector’s digital operational resilience and safeguard its stability.

Key areas covered by DORA are:

• Gestión de riesgos TIC: Establishing a framework to address and mitigate ICT risks
• Gestión de riesgos de terceros: Monitoring and ensuring resilience standards for ICT service providers
• Pruebas de resiliencia: Conducting basic and advanced tests to strengthen ICT systems
• ICT Incidents: Managing and reporting ICT-related incidents
• INTERCAMBIO DE INFORMACIÓN: Exchanging intelligence on cyber threats and vulnerabilities
• Supervisión de terceros: Ensuring compliance and reducing risks with critical ICT providers

What are Essentials Eight?

The Essential Eight is a set of strategies designed to protect organizations’ internet-connected IT networks from cyber threats. While these principles can be adapted for enterprise mobility and operational technology networks, they were specifically created for IT systems, so unique environments may need different approaches for certain cyber risks.

Notably, it is developed by the Australian Signals Directorate (ASD) and forms part of their prioritized strategies to mitigate cyber security incidents. 

These strategies are considered the most effective for safeguarding against a wide range of cyber threats.

Now, if you are curious, the Ocho esenciales incluye:

• Patching applications
• Patching operating systems
• Implementar la autenticación multifactor
• Restricción de privilegios administrativos
• Control de aplicaciones
• Restricting Microsoft Office macros
• Hardening user applications
• Performing regular backups

How to Integrate DORA Principles with Essential Eight

Integrating DORA principles into the Essential Eight is not something you see much of, as both are very recent developments. However, you must find a balance where they naturally complement each other. 

The Essential Eight gives you a strong foundation by focusing on protecting IT networks with practical, hands-on strategies like patching, multi-factor authentication, and backups. On the other hand, DORA adds a regulatory lens to the mix so that your processes remain resilient, compliant, and prepared for disruptions.

Essential Eight handles the “how” of cybersecurity, such as preventing vulnerabilities and reducing risks. DORA then steps in with the “why,” ensuring that these measures align with broader operational resilience goals, particularly for financial entities. 

Por ejemplo,

• Ocho esenciales: Regularly patching applications and operating systems helps prevent known vulnerabilities from being exploited.
• DORA: Mandates that organizations assess the impact of ICT risks on operations and establish contingency plans to address disruptions caused by unpatched systems.

Things start to connect with incident management and testing. Essential Eight helps prevent incidents, while DORA takes it further by requiring structured reporting and advanced resilience testing. 

Together, these approaches help you avoid problems and handle them effectively if they arise.

As an investment firm, combining the controls of Essential Eight with the regulatory strength of DORA has been shown to recover faster and with fewer long-term impacts after disruptions. 

Who Does DORA and Essential 8 Apply to?

It’s a common misconception that DORA applies not only to banks and financial institutions but also to critical suppliers that support the financial sector. 

For instance, if a company manages a bank’s network, it falls under DORA’s scope. 

The logic is simple: even if a bank is secure, an insecure ICT supplier can still pose a significant risk.

That’s why DORA includes these suppliers, though their rules might differ slightly from those for banks or asset managers.

For large organizations like major banks or pension funds, DORA may not be a massive shift since they’re already heavily invested in security. These companies would likely just need to do a gap analysis to identify areas where they need to align further. 

However, for smaller businesses, DORA might mean implementing security measures they’ve never had to consider before.

While the Essential Eight isn’t legally mandated, it’s strongly recommended for all Australian organizations, including businesses and government agencies. Adopting it helps reduce cyber risks and strengthen overall security, a crucial step for any entity looking to protect its systems and data effectively.

Sprinto: The one-stop solution for DORA compliance

DORA does not require third-party audits or certifications, but they’re highly recommended to demonstrate ongoing compliance. 

As a financial company, you must implement DORA’s requirements through strong security programs and validate their efforts through internal and external reviews, similar to GDPR. 

Noncompliance comes with risks—fines, recovery costs after cyber incidents, legal liabilities, and reputational damage. The solution? Regularly audit and improve your ICT risks and security posture.

Sprinto GRC automation platform is a trusted partner that helps you achieve and maintain DORA compliance. Here’s how Sprinto supports organizations:

• DORA Gap Analysis: Sprinto helps assess your current practices against DORA requirements, guided by experts and external implementation partners.
• Gestión de riesgos: Sprinto’s built-in risk register, aligned with ISO 27005, can be used to identify internal and external risks. It supports risk assessments and helps implement tailored controls, policies, and risk treatments.
• Gestión de riesgos del proveedor: Sprinto enables you to build or audit your vendor risk management program, ensuring due diligence and ongoing monitoring for critical third-party providers.
• Marco de gobernanza: Document and publish policies, manage acknowledgment campaigns, and maintain version control for all policies within the Sprinto platform.
• SCF Control Mapping: Sprinto includes 102 built-in SCF (Secure Control Framework) controls mapped to DORA requirements. Automated workflows and real-time dashboards track compliance and alert you to changes.
• Recopilación automatizada de evidencias: The platform streamlines internal and external audits by centralizing evidence in an automated Evidence Hub, reducing manual effort and audit preparation time.

¿Te interesa? Get on a call to know more.

Preguntas frecuentes