Ireland’s Pensions Authority has published an information note on the Digital Operational Resilience Act (DORA) for trustees.

The EU regulation will come into force on 17 January 2025 and aims to strengthen digital operational resilience in the financial sector. As part of the regulation harmonised requirements for financial entities on the use of ICT services will be introduced.

“Trustees will bear ultimate responsibility for ensuring their scheme’s compliance with the requirements, irrespective of any outsourcing arrangements in place,” the authority said.

The way the DORA requirements apply to a scheme will depend on the size of the scheme’s active and deferred membership. Schemes with 100 or more active and deferred members are subject to all DORA requirements.

Schemes with 16-99 active and deferred members are subject to most DORA requirements. However, a simplified version of the ICT risk management framework applies for these schemes, and they are exempt from performing advanced testing of ICT systems and from having to adopt a strategy on ICT third-party risk.

Schemes with 15 or less active and deferred members are not subject to DORA.
Trustees must document and maintain a comprehensive ICT risk management framework to include ICT business continuity plans and other policies and controls, as part of the overall risk management system.

They will also need to identify all sources of ICT risk and cyber threats continuously together with ongoing monitoring of the security and functioning of ICT systems relied on.

Those who use third-party ICT services must ensure that key contractual provisions are in place with service providers as set out in Article 30 of DORA. They will also need to maintain a register of information on all contractual arrangements on the use of ICT services provided by third-party providers.

In addition, trustees will be required to manage and report major ICT-related incidents to the Pensions Authority and keep a record of significant cyber threats and they will need to test ICT systems supporting critical functions at least yearly.

The guidance can be accessed here.

---