DORA Year Two: Can Your SOC Actually See the Attack?
DORA year two pushes EU financial firms to prove SOC visibility and timely incident detection.
A commentary on the EU Digital Operational Resilience Act says financial firms spent DORA's first year, after it became enforceable in January 2025, on governance, third-party assessments, and incident workflows. In year two, regulators are pressing entities to show that monitoring and ICT-incident handling actually work. The piece maps Articles 9, 10, 19, and 28-30 to network visibility and argues that network detection and response can expose command-and-control, lateral movement, and third-party connection drift that endpoint logs may miss. Initial notice of a major ICT incident must come within four hours of classification and no later than 24 hours after awareness.
- DORA has been enforceable across the EU since January 2025.
- Year two emphasizes proving detection, not only governance paperwork.
- Articles 9 and 10 require continuous monitoring and fast anomaly detection.
- Major-incident notice is due within four hours of classification or 24 hours of awareness.
- The article argues NDR fills visibility gaps left by inventories, logs, and EDR.
From the original article
4 min read at thehackernews.com
When the Digital Operational Resilience Act (DORA) became enforceable across the European Union in January 2025, it triggered an administrative sprint. Financial entities spent the first year establishing risk governance, assessing third-party service providers, updating contract clauses, and documenting incident escalation workflows. Now in its second year, the harder part of DORA is
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.