Connect with us

Business

Building Digital Resilience: The Roadmap to DORA Readiness 

Source: Finance Derivative

Rob Otto, EMEA Field CTO at Ping Identity

As we edge closer to the January 2025 deadline for the Digital Operational Resilience Act (DORA), the sense of urgency for organisations in the financial services sector to ready themselves is palpable. DORA marks a watershed in regulatory standards, stressing the essential need for these institutions to bolster their defences against digital disruption.

At its core, DORA is designed to ensure the financial sector’s digital infrastructure is robust enough to withstand and recover from technological disruptions. However, the journey to DORA compliance is shadowed by past incidents, like the massive cyberattacks on financial institutions, which have exposed millions of customer records, and system outages that left customers without access to banking services for days. Adding to the complexity, many firms struggle with legacy systems ill-suited to modern cybersecurity demands and a threat landscape that evolves more rapidly than they can adapt. This backdrop makes the path to readiness challenging yet non-negotiable, emphasising the urgent need for action.

There will be certain intricacies as organisations navigate DORA compliance. This act, with its profound repercussions for how we manage costs, spur innovation, and sustain profitability, is a wakeup call for finance firms. The prospect of large-scale cyberattacks warrants a big shift to how they proactively and reactively defend their business and their customers. 

Understanding DORA

DORA sets forth stringent requirements for financial entities. All 22,000 of them, including banks, insurance companies, and investment firms, not to mention the growing third-party ecosystem, must all focus on risk management, reporting, and testing of ICT systems. The Act forms part of the EU’s wider Digital Finance Package that is designed to give consumers protection and financial stability.

For stakeholders, DORA introduces a dual challenge: adhering to rigorous standards while continuing to innovate and compete in a rapidly evolving digital landscape. This balancing act is crucial, as we’ll discuss later, non-compliance not only risks regulatory sanctions but can also undermine consumer trust and corporate integrity.

Considering these challenges, it’s essential for organisations to understand the specific demands of DORA, including the need for a comprehensive risk management framework, detailed incident reporting procedures, and regular IT system testing. Such measures are not just regulatory obligations, but are pivotal in fortifying operational resilience and safeguarding against potential financial and reputational losses.

The importance of compliance

DORA compliance is more than a checkbox for regulatory adherence. It’s a strategic pivot toward ensuring enduring trust and maintaining a pristine reputation in a time where digital setbacks are inevitable realities rather than just possibilities.

This strategic imperative is vital for financial organisations as the resilience of their ICT systems not only dictates their ability to navigate challenging regulatory environments, but also reinforces their market standing by evidencing a steadfast commitment to operational excellence and the safeguarding of customer trust.

Practical steps towards compliance

Achieving compliance with DORA requires a structured approach, beginning with a thorough assessment of the current state of an organisation’s digital operational resilience. This assessment should consider four key elements to identify gaps in compliance and areas for improvement in risk management frameworks, incident reporting mechanisms, and IT system testing.

1. Develop a compliance roadmap: Outline a detailed plan that addresses identified gaps, allocates resources, and sets clear timelines for compliance milestones.

2. Enhance risk management frameworks: Integrate DORA’s requirements into existing risk management processes, ensuring digital operational risks are adequately identified, assessed, and mitigated.

3. Establish robust incident reporting procedures: Implement mechanisms for the timely detection and reporting of IT-related incidents, in line with DORA’s requirements.

4. Conduct regular IT system testing: Schedule and execute regular testing of IT systems to evaluate resilience against disruptions. This testing should be both thorough and reflective of real-world scenarios.

Leveraging digital identity for DORA readiness

Digital identity plays a pivotal role in establishing strong cybersecurity and business recovery strategies. By securing digital identities and transactions, organisations can significantly mitigate the risk of disruptions caused by cyber threats—a key component of digital operational resilience. Identity and Access Management (IAM) is critical in bolstering cybersecurity and aiding compliance, managing secure access, and protecting data. Here’s how:

– Authentication and access management: Implementing strong authentication and access management controls ensures that only authorised users can access critical systems, reducing the risk of breaches and disruptions.

– Automated compliance reporting: Leveraging digital identity solutions can automate the generation of compliance reports, making it easier for organisations to meet DORA’s reporting requirements.

– Enhanced incident response: Digital identity platforms can facilitate rapid detection and response to security incidents, a crucial component of DORA’s incident management requirements.

Final remarks

2025 will mark a milestone for financial service providers on a long-term journey towards digital supremacy and robustness. It’s perhaps one they might not have realised was completely necessary before the Act was imposed, nonetheless, the directives laid down by DORA, while stringent, will help them to navigate the digital perils of today and arm themselves against tomorrow’s uncertainties.

Adopting the DORA mandates is more than a regulatory exercise; it’s an opportunity to fundamentally rethink our digital operational strategies. It challenges us to look beyond compliance as a mere requirement, viewing it instead as a lever for strategic advancement and innovation.

For those of us steering these financial institutions, it’s time to reflect and act. Consider how we can extend our ambitions beyond the baseline of DORA compliance to redefine our digital operational ethos. And how we can embrace DORA’s principles as a catalyst for continuous innovation and improvement within our realms.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Business

AI and GenAI tools can add business value – but the right skills are vital to make this possible

Source: Finance Derivative

Faye Ellis, Principal Training Architect – AWS at Pluralsight

Generative AI has captured the imagination of many over the past year. However, aside from using ChatGPT to write our wedding speeches and do our kid’s homework, there are many ways to maximise the technology to add real business value and a competitive edge.

Getting the right skills in place for employees is also key for businesses. Whether employees are total beginners to AI or looking to move into advance uses, investment in the technology will only bring true business benefits if people are empowered to work with it effectively, try new applications, and do so securely.

Here are four examples of where AI, when used well, can bring real business value:

Build your own chatbots

Conversational chatbots and virtual assistants can increase customer engagement in an interactive and personalised way. They can be tailored to reflect brand voice, and be delivered in a consistent way across a site so customers always have access to timely support.

Amazon Lex, for example, makes it easy to build high-quality conversational interfaces powered by generative AI. 

Automate your repetitive business processes

Generative AI is ideal for automating repetitive tasks that don’t require high levels of creativity, such as reviewing and summarising contracts, generating project collateral, and code documentation. FAQ engines that handle common customer support and HR inquiries are expected to become commonplace. Marketing teams that need to develop campaigns in a similar style to previously successful campaigns, or automate customer outreach, will also find that they can easily automate these repetitive tasks with generative AI. 

Content marketers can use services like Bedrock to build a social media campaign for a new product or service. Marketers provide relevant data and prompts, and Bedrock generates copy and images for targeted social media posts. 

Incorporate generative AI into your cybersecurity

Generative AI can be used in risk modelling and assessing and interpreting the risk of cybersecurity incidents and findings.

Use generative adversarial networks (GANs) to create synthetic data, enabling security experts to anticipate what might happen during a cyber attack

Generate image, video, and text

Most of us are familiar with image, video, and text generation—the primary capabilities of generative AI. Use cases include creating original content, images, and summarising text.

Leading pre-trained AI models are available through SageMaker and Bedrock to help you get started quickly. Use Bedrock Chat Playground to experiment with various models using a chat interface.  

Getting your teams up to speed with AI

To start using these technologies, you need your staff to be skilled in using them.

Organisations might be accelerating AI adoption, but employees need the right skills – otherwise organisations risk facing an AI literacy gap. In fact, our recent research found that 80% of executives currently neglect employee training, and 20% don’t have an understanding of their teams’ AI skills.

By focusing on training the existing talent pool, it’s possible to propel them through the next wave of AI innovation, and fill talent gaps from within.

Continue Reading

Business

How can a payments strategy support business growth?

Source: Finance Derivative

Following the global economic upheaval brought on by the pandemic, businesses are once again prioritising growth on a global scale. While every business recognises the importance of expansion, their methods, obstacles, and risks differ greatly.

In the following article, Sonya Geelon, Chief Commercial Officer at Conferma, explores some of the most common challenges holding businesses back, and how by including innovative payments solutions in your payment strategy, you can successfully position your business to expand into global markets.

Barriers to global expansion

At Conferma, we wanted to know what businesses felt stood between them and their growth ambitions, so we spoke to 400 financial decision makers to find out.

The research, shared in our new Growth Ignition Index report, identified global expansion as a key priority for businesses looking to grow across all regions. Significant drivers included increasing customer demand (46 per cent), maintaining a consistent cashflow (36 per cent) and undertaking digital transformation (34 per cent.) Businesses also highlighted a number of barriers, such as identifying valuable markets to expand into (27 per cent) and navigating complex cross-border payment systems (13 per cent.) The following sheds light on some of the factors that businesses perceive to be hindering their growth.

Operational inefficiencies

It’s a well-known fact that operational efficiency is crucial for giving businesses the competitive edge. If your processes run smoothly and effectively, you’re likely in a good position to grow. However, a third (33 per cent) of businesses identified operational inefficiencies as a significant sticking point, particularly among small-and-medium sized organisations. This perhaps indicates that larger companies have already invested in boosting efficiency to a degree, however, the issue was noted across businesses of all sizes.

Complex cross-border payments

Successful growth relies heavily on being able to make fast, seamless transactions, however, recent research from Rapyd found that 38 per cent of businesses experience delays of five days or more when sending or receiving international payments.[1] Costs and delays in cross-border transactions can have a significant impact on growth, cutting into revenues, restricting cash flow and complicating financial planning. Our own research highlighted this, with 14 per cent of businesses reporting slow and/or complex cross-border payments as a significant barrier to expansion.

So how can businesses overcome these challenges and unlock global growth?

Taking your payments strategy virtual

Amid the array of payment options available in the market, virtual cards have emerged as a versatile solution, valued by users globally. According to Juniper Research, the global value of virtual cards will increase over threefold in just 5 years, climbing from $1.9 trillion in 2021 to a staggering $6.8 trillion by 2026.[2]

So how do they work?

Virtual cards are essentially digital versions of traditional credit cards. The technology generates a 16-digit card  number, allowing an employee to make payments without having to physically hand over a card. Instead, they provide the virtual card number, expiration date, and security code, just like they would with a regular credit or debit card.

Virtual cards come with built-in fraud and security features, enabling restrictions on usage. For instance, users can set a specific date range or limit usage to certain merchants. This ensures that any attempts to exceed the set amount, use the card at unauthorised merchants, or spend beyond the specified date range will result in a declined transaction.

Using a virtual card provider allows access to extensive, pre-existing payments ecosystems. For example, Conferma connects 75+ card issuers and banks across the world. This enables businesses to use virtual cards in 62 different currencies, making international payments frictionless while mitigating costly cross-border fees. Virtual cards can also help boost cashflow and improve operational efficiency, automating reconciliation and cutting lengthy processing times. By removing convoluted payment processes, virtual cards give businesses the freedom to grow in the markets they deem most valuable, not just most accessible.

Of those surveyed, four out of five  respondents (82 per cent) plan on expanding their virtual card usage in the next twelve months, with 64 per cent extending usage to additional payment needs. Businesses already using virtual cards also anticipate a substantial increase in the volume of payments they make virtually, with our data projecting a rise from 45 to 57 per cent of all payments being made using virtual cards in the next 12 months.

Virtual cards offer a compelling solution to the challenges limiting international growth by offering enhanced security, streamlined operational processes, and seamless cross-border transactions. By embracing virtual cards as a strategic tool, organisations can unlock opportunities for growth and innovation, empowering them to navigate the complexities of international commerce with ease.


[1] The 2023 State of Cross-Border Payments, Rapyd, 2023.

[2] Virtual Cards: B2B and B2C Applications, Competitive Analysis & Market Forecasts 2021-2026, Juniper Research

Continue Reading

Business

How can businesses make the cloud optional in their operations?

Max Alexander, Co-founder at Ditto

Modern business apps are built to be cloud-dependent. This is great for accessing limitless compute and data storage capabilities but when connection to the cloud is poor or shuts down, business apps stop working, impacting revenue and service. If real-time data is needed for quick decision-making in fields like healthcare, a stalled app can potentially put people in life-threatening situations.

Organisations in sectors as diverse as airlines, fast food retail, and ecommerce that have deskless staff who need digital tools accessible on smartphones, tablets and other devices to do their jobs. But because of widespread connectivity issues and outages, these organisations are beginning to consider how to ensure these tools can operate reliably when the cloud is not accessible. 

The short answer is that building applications with a local-first architecture can help to ensure that they remain functional when disconnected from the internet. But then, why are not all apps built this way? The simple answer is that building and deploying cloud-only applications is much easier as ready-made tools for developers help expedite a lot of the backend building process. The more complex answer is that a local-first architecture solves the issue of offline data accessibility but does not solve the critical issue of offline data synchronisation. Apps disconnected from the internet still have no way to share data across devices. That is where peer-to-peer data sync and mesh networking come into play.

Combining offline-first architecture with peer-to-peer data sync

In the real world, what does an application like this look like?

  • Apps must prioritise local data sync. Rather than sending data to a remote server, applications must be able to write data using its local database in the first instance, and then listen for changes from other devices, and recombine them as needed. Apps should utilise local transports such as Bluetooth Low Energy (BLE) and Peer-to-Peer WiFi (P2P Wi-Fi) to communicate data changes in the event that the internet, local server, or the cloud is not available.
  • Devices are capable of creating real-time mesh networks. Nearby devices should be able to discover, communicate, and maintain constant connections with devices in areas of limited or no connectivity.
  • Seamlessly transition from online to offline (and vice versa). Combining local sync with mesh networking means that devices in the same mesh are constantly updating a local version of the database and opportunistically syncing those changes with the cloud when it is available.
  • Partitioned between large peer and small peer mesh networks to not overwhelm smaller networks if they try to sync every piece of data. In order to do this, smaller networks will only sync the data that it requests, so developers have complete control over bandwidth usage and storage. This is vital when connectivity is erratic or critical data needs prioritising. Whereas, the larger networks sync as much data as they can, which is when there is full access to cloud-based systems.
  • Ad-hoc to enable devices to join and leave the mesh when they need to. This also means that there can be no central server other devices are relying on.
  • Compatible with all data at any time. All devices should account for incoming data with different schemas. In this way, if a device is offline and running an outdated app version, for example, it still must be able to read new data and sync.

Peer-to-peer sync and mesh networking in practice

Let us take a look at a point-of-sale application in the fast-paced environment of a quick-service restaurant. When an order is taken at a kiosk or counter, that data must travel hundreds of miles to a data centre to arrive at a device four metres away in the kitchen. This is an inefficient process and can slow down or even halt operations, especially if there is an internet outage or any issues with the cloud.

A major fast-food restaurant in the US has already modernised its point of sale system using this new architecture and created one that can move order data between store devices independently of an internet connection. As such, this system is much more resilient in the face of outages, ensuring employees can always deliver best-in-class service, regardless of internet connectivity.

The vast power of cloud-optional computing is showcased in healthcare situations in rural areas in developing countries. By using both peer-to-peer data sync and mesh networking, essential healthcare applications can share critical health information without the Internet or a connection to the cloud. This means that healthcare workers in disconnected environments can now quickly process information and share it with relevant colleagues, empowering faster reaction times that can save lives.

Although the shift from cloud-only to cloud-optional is subtle and will not be obvious to end users, it really is a fundamental paradigm shift. This move provides a number of business opportunities for increasing revenue and efficiencies and helps ensure sustained service for customers.

Continue Reading

Copyright © 2021 Futures Parity.