{"id":2910,"date":"2026-10-09T05:50:42","date_gmt":"2026-10-09T05:50:42","guid":{"rendered":"https:\/\/ulici.ro\/?p=2910"},"modified":"2026-10-09T05:52:10","modified_gmt":"2026-10-09T05:52:10","slug":"ce-este-dora-si-de-ce-schimba-regulile-jocului-in-sectorul-financiar-what-is-dora-and-why-is-it-changing-the-game-in-the-financial-sector","status":"publish","type":"post","link":"https:\/\/ulici.ro\/en\/ce-este-dora-si-de-ce-schimba-regulile-jocului-in-sectorul-financiar-what-is-dora-and-why-is-it-changing-the-game-in-the-financial-sector\/","title":{"rendered":"Ce este DORA \u0219i de ce schimb\u0103 regulile jocului \u00een sectorul financiar? \/ What is DORA and why is it changing the game in the financial sector?"},"content":{"rendered":"

Ce este DORA \u0219i de ce schimb\u0103 regulile jocului \u00een sectorul financiar?<\/strong><\/h3>\n\n\n\n

Odat\u0103 cu aplicarea sa efectiv\u0103 \u00eencep\u00e2nd cu 17 ianuarie 2025<\/strong>, Regulamentul privind Rezilien\u021ba Opera\u021bional\u0103 Digital\u0103 (DORA<\/strong>) a marcat o schimbare fundamental\u0103 \u00een modul \u00een care Uniunea European\u0103 prive\u0219te securitatea cibernetic\u0103 \u00een domeniul financiar. Miza nu mai este doar prevenirea atacurilor, ci capacitatea real\u0103 a institu\u021biilor de a rezista, de a reac\u021biona rapid \u0219i de a-\u0219i reveni \u00een cazul unor defec\u021biuni sau incidente informatice majore.<\/p>\n\n\n\n

Fie c\u0103 vorbim despre b\u0103nci, societ\u0103\u021bi de asigur\u0103ri sau firme de investi\u021bii, regulamentul unific\u0103 standardele de securitate tehnic\u0103 pentru 20 de categorii distincte de entit\u0103\u021bi financiare<\/strong>, extinz\u00e2ndu-se direct \u0219i asupra furnizorilor ter\u021bi de servicii IT<\/strong> (ICT third-party service providers).<\/p>\n\n\n\n

De ce a fost nevoie de o astfel de reglementare?<\/strong><\/h3>\n\n\n\n

Ast\u0103zi, serviciile financiare func\u021bioneaz\u0103 aproape exclusiv prin intermediul tehnologiei. Aceast\u0103 dependen\u021b\u0103 profund\u0103 de infrastructurile digitale \u0219i de companiile de software a deschis \u00eens\u0103 vulnerabilit\u0103\u021bi majore \u00een fa\u021ba atacurilor cibernetice.<\/p>\n\n\n\n

Atunci c\u00e2nd riscurile IT nu sunt gestionate riguros, o simpl\u0103 pan\u0103 de sistem sau o bre\u0219\u0103 de securitate la un furnizor ter\u021b poate bloca tranzac\u021bii transfrontaliere. Un astfel de incident se poate propaga rapid domino \u00een alte sectoare, destabiliz\u00e2nd \u00een final \u00eentreaga economie. DORA a fost creat tocmai pentru a elimina aceste puncte unice de vulnerabilitate.<\/p>\n\n\n\n

Pilonii centrali ai regulamentului DORA<\/strong><\/h3>\n\n\n\n

Cadrul DORA nu se limiteaz\u0103 la recomand\u0103ri generale, ci impune cerin\u021be concrete structurate pe \u0219ase direc\u021bii majore:<\/p>\n\n\n\n

    \n
  • Gestionarea riscului IT:<\/strong> Setarea unor principii solide privind guvernan\u021ba \u0219i cadrul intern de minimizare a riscurilor cibernetice.<\/li>\n\n\n\n
  • Supravegherea furnizorilor ter\u021bi de tehnologie:<\/strong> Monitorizarea constant\u0103 a riscurilor generate de dependen\u021ba de furnizori externi \u0219i includerea unor clauze contractuale obligatorii.<\/li>\n\n\n\n
  • Testarea rezilien\u021bei opera\u021bionale:<\/strong> Derularea periodica de teste de securitate, de la evalu\u0103ri de baz\u0103 p\u00e2n\u0103 la teste avansate de penetrare (penetration testing).<\/li>\n\n\n\n
  • Raportarea incidentelor de securitate:<\/strong> Obliga\u021bia de a clasifica \u0219i de a raporta rapid autorit\u0103\u021bilor competente orice incident IT major.<\/li>\n\n\n\n
  • Schimbul de informa\u021bii:<\/strong> \u00cencurajarea partaj\u0103rii voluntare de date \u0219i analize privind amenin\u021b\u0103rile cibernetice \u00eentre entit\u0103\u021bile financiare.<\/li>\n\n\n\n
  • Mecanismul european de supraveghere:<\/strong> Un cadru strict dedicat furnizorilor critici de servicii IT (CTPPs), creat pentru a preveni riscurile de concentrare \u2014 de exemplu, situa\u021biile \u00een care prea multe b\u0103nci depind de acela\u0219i furnizor de servicii Cloud.<\/li>\n<\/ul>\n\n\n\n
    \n\n\n\n

    What is DORA and why is it changing the game in the financial sector?<\/strong><\/h3>\n\n\n\n

    With its official implementation coming into effect on January 17, 2025<\/strong>, the Digital Operational Resilience Act (DORA<\/strong>) marked a fundamental shift in how the European Union views cybersecurity within the financial domain. The focus is no longer merely on preventing cyberattacks, but on building genuine organizational capacity to withstand, swiftly react to, and recover from major IT disruptions or system failures.<\/p>\n\n\n\n

    Whether referring to banks, insurance companies, or investment firms, the regulation harmonizes technical security standards across 20 distinct categories of financial entities<\/strong>, while extending directly to third-party ICT (Information and Communication Technology) service providers<\/strong>.<\/p>\n\n\n\n

    Why Was This Regulation Necessary?<\/strong><\/h3>\n\n\n\n

    Today, financial services operate almost exclusively through technology. However, this deep reliance on digital infrastructure and software vendors has exposed major vulnerabilities to cyber threats.<\/p>\n\n\n\n

    When IT risks are not rigorously managed, a simple system outage or security breach at a third-party vendor can disrupt cross-border transactions. Such an incident can rapidly trigger a domino effect across other sectors, ultimately destabilizing the broader economy. DORA was established specifically to eliminate these single points of failure.<\/p>\n\n\n\n

    The Core Pillars of DORA<\/strong><\/h3>\n\n\n\n

    The DORA framework goes beyond general recommendations by enforcing concrete requirements structured around six major pillars:<\/p>\n\n\n\n

      \n
    • ICT Risk Management:<\/strong> Establishing robust principles for governance and internal risk minimization frameworks.<\/li>\n\n\n\n
    • ICT Third-Party Risk Management:<\/strong> Continuously monitoring risks stemming from reliance on external vendors and embedding mandatory contractual provisions.<\/li>\n\n\n\n
    • Digital Operational Resilience Testing:<\/strong> Conducting periodic security tests, ranging from basic evaluations to advanced threat-led penetration testing (TLPT).<\/li>\n\n\n\n
    • Incident Reporting:<\/strong> Obligating entities to classify and rapidly report major ICT-related incidents to competent regulatory authorities.<\/li>\n\n\n\n
    • Information Sharing:<\/strong> Encouraging voluntary peer-to-peer exchanges of cyber threat intelligence and analytics among financial entities.<\/li>\n\n\n\n
    • European Oversight Mechanism:<\/strong> A strict framework dedicated to critical third-party ICT providers (CTPPs), designed to mitigate concentration risks\u2014such as scenarios where multiple major banks rely on the same single cloud provider.<\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"

      Ce este DORA \u0219i de ce schimb\u0103 regulile jocului \u00een sectorul financiar? Odat\u0103 cu aplicarea…<\/p>","protected":false},"author":1,"featured_media":2400,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_uag_custom_page_level_css":"","_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2910","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-chestiuni-generale-cu-referire-la-drept"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t