Navigating compliance with the Digital Operational Resilience Act

Summary

The Digital Operational Resilience Act (DORA) is a European Union (EU)-wide regulatory framework aimed at enhancing the digital operational resilience of financial service institutions (FSIs) operating within the EU. It ensures that these entities can withstand, respond to, and recover from all types of Information and Communication Technologies (ICT)-related disruptions and threats. DORA applies to a wide range of financial entities that have operations within the EU, as well as critical ICT third-party service providers to such financial entities. The regulation will take effect on January 17, 2025.

In recognizing Genesys role as an ICT third-party service provider of potentially critical services, we understand that achieving compliance with DORA is about empowering and supporting our financial services customers and partners to meet their regulatory obligations, while strengthening their resilience. Within this shared responsibility model, our goal is to offer clarity on our approach and demonstrate how we effectively maintain the continuity and security of our services.

At Genesys, our commitment to compliance began early, with the establishment of a regulatory task force. This cross-functional team, supported by executive sponsorship, is charged with overseeing regulatory developments and ensuring the implementation of all necessary controls across our organization. The task force ensures that our operational practices remain consistent with the requirements of applicable regulations, including DORA, as they evolve, facilitating our customers’ and partners’ journeys toward compliance.

Genesys operates under a robust security and compliance framework, continuously validated through independent third-party attestations. These attestations serve to reinforce the security, privacy, and resilience of our solutions. Understanding the complexities that financial institutions face in meeting their regulatory requirements, Genesys has a dedicated Contact Center as a Service (CCaaS) Center of Excellence (COE), composed of security, privacy, and compliance professionals, who provide structured guidance through close collaboration with various business units and stakeholders. Genesys has also developed a Financial Services Addendum (FSA) tailored specifically to address the compliance needs of our in-scope financial services customers and partners, including those involved through vendor arrangements.

For those seeking deeper engagement or tailored guidance, Genesys encourages its customers and partners to reach out to their designated account executive or customer success manager to connect with our COE. Our experts are prepared to offer detailed insights and recommendations that will aid in ensuring alignment with DORA obligations and enhance the overall resilience of the digital ecosystems we support.

Introduction

This publication offers a comprehensive overview of key DORA requirements and outlines how Genesys aligns its activities with these principles. It outlines the five pillars of the DORA framework—ICT risk management, incident reporting, operational resilience, third-party risk management, and information sharing and oversight—and explains how these pillars are embedded into Genesys’ operational practices. In doing so, Genesys not only addresses the requirements of DORA, but also helps its financial services customers and partners benefit from a trusted service provider committed to operational resilience, security, and data protection.

Additionally, this publication details Genesys’ certification and compliance programs and compliance strategy. It also answers frequently asked questions regarding DORA.

Understanding the five pillars of DORA

1. ICT risk management: Genesys uses industry-leading strategies to manage ICT risks, ensuring that our customers’ data and services remain secure and resilient against cyberthreats and operational disruptions.
2. Incident reporting: Our incident reporting mechanisms are robust, ensuring that, in the event of any significant disruption, we can quickly notify the appropriate entities and provide our customers with timely, transparent updates on incident resolution.
3. Operational resilience: Resilience is at the core of Genesys’ service design. We have adopted comprehensive resilience testing, including scenario analysis and continuity planning, to promote uninterrupted service and world-class availability, even in the face of unforeseen challenges.
4. Third-party risk management: Genesys takes a proactive approach to managing risks within our supply chain. We support the alignment of relevant subcontractors and third-party vendors with our compliance initiatives, promoting seamless integration into your resilience strategies.
5. Information sharing and oversight: As part of our commitment to operational excellence, we engage in ongoing dialogue with financial entities and collaborate with relevant stakeholders to enhance oversight and share critical information for improved resilience.

Genesys response to key DORA requirements

Contractual safeguards

• Requirement: Contracts between subcontractors and financial entities must include clear definitions of the ICT services provided and the terms under which downstream subcontracting is permitted. These contracts should also specify the obligations of subcontractors regarding compliance with DORA.
• Genesys response: Genesys, in viewing itself as a subcontractor of critical ICT services, has reviewed and refreshed its contracts to ensure they address the obligations set forth in DORA. This includes defining the scope of services, identifying subcontractor and customer obligations, such as audit rights and pen testing, and describing the processes for monitoring and auditing compliance throughout the service delivery chain.

Threat-led penetration testing (TLPT)

• Requirement: DORA mandates that certain financial entities are to regularly conduct TLPT to test the resilience of ICT systems against sophisticated cyber threats. These tests are essential for identifying vulnerabilities and enhancing the overall security posture.
• Genesys response: Genesys has an extensive penetration testing program of its Genesys Cloud platform that includes the ability for customers to request additional testing based on customer identified needs.

Supply chain management

• Requirement: DORA emphasizes the need for transparency and accountability across the entire supply chain, particularly when critical services are subcontracted. Financial entities must be assured that all subcontractors in the supply chain comply with standards as defined in the regulation.
• Genesys response: Genesys has a comprehensive supply chain management program that includes due diligence procedures for selecting and onboarding subcontractors, continuous monitoring, and regular audits.

ICT risk management framework

• Requirement: DORA mandates the establishment of a resilient ICT risk management framework that encompasses all critical functions. This framework must be dynamic, capable of evolving with emerging threats, and comprehensive enough to cover all aspects of the ICT landscape.
• Genesys response: We’ve enhanced our proactive risk management framework that continuously identifies, assesses, and mitigates risks. This includes regular reviewing, updating, and testing of our risk management policies and integrating the latest threat intelligence and best practices into our framework.

Incident reporting obligations

• Requirement: DORA requires the timely reporting of major ICT-related incidents to affected financial entities. The regulation specifies timelines and necessary information that must be provided in such reports.
• Genesys response: Genesys has an advanced incident detection and response system that ensures rapid identification, classification and reporting of incidents. This system is integrated with broader security operations within Genesys to ensure swift communication and compliance with DORA’s reporting timelines.

Certifications and compliance programs

Genesys is dedicated to upholding the highest standards of security, privacy, and operational resilience. To support our compliance efforts and provide assurance to our customers, we have obtained and continuously maintain the following certifications and participate in recognized compliance programs.

Genesys integrated compliance strategy

Under Genesys’ integrated compliance strategy, we align DORA’s regulatory requirements with our existing compliance programs by embedding its core pillars into our operational processes. This approach ensures that compliance is not treated as a separate function, but is integrated into our business practices, allowing us to proactively meet DORA’s standards, while maintaining resilience across our operations.

Unified risk management approach

Genesys takes a broad approach to risk management by including developing regulatory environments, such as DORA, NIS2 and the EU AI Act. We have a holistic approach that integrates ICT risk, AI governance, business continuity and disaster recovery, and cybersecurity measures into a cohesive strategy. This unified approach fosters resilience, promotes innovation and helps protect our services from evolving risks across regulatory domains.

Centralized incident reporting

We have an incident reporting system that not only addresses DORA’s reporting obligations, but also aligns with other regulations such as the NIS2 directive, which allows for efficient communication with our customers and partners and assures that incidents are reported and acted upon promptly.

Enhanced subcontractor management

Our subcontractor management process includes risk-based due diligence, contractual compliance measures and audits in line with identified risk profiles. This approach provides continuous monitoring of subcontractor performance and compliance so that all parties that are involved in delivering critical services adhere to the highest standards.

Training and awareness

Our training programs are regularly updated to cover regulatory developments. Employees across the organization receive training, emphasizing the importance of security and privacy, including awareness of and responsibilities under applicable regulatory frameworks. Genesys employees are equipped with access to the knowledge necessary to maintain compliance in their daily operations and decision-making processes.

Organizational coordination

Collaboration across teams enables a unified understanding of Genesys’ obligations under regulations like DORA and ensures a coordinated response. This collective effort breaks down silos, ensuring all teams operate from the same playbook. Regular cross-functional meetings and system updates keep us agile in the face of regulatory changes, fostering a culture of proactive compliance that enhances our operations across all services and regions.

Beyond DORA: Considerations for NIS2 and the EU AI Act

While DORA is the focus of this publication, it’s also essential to acknowledge the overlapping and complementary requirements of NIS2 and the upcoming EU AI Act.

NIS2: As a directive that enhances cybersecurity across critical sectors in the EU, NIS2 shares several common objectives with DORA, particularly in cybersecurity risk management and incident reporting. Genesys is monitoring the enactment of NIS2 by individual EU countries and will evaluate such developments as part of our broader risk management framework, as applicable.

EU AI Act: The EU AI Act introduces regulations on the deployment and use of AI, particularly for high-risk AI systems. For Genesys, this means AI-driven services must comply with requirements of the AI Act, including risk management, transparency and human oversight. Genesys is closely tracking developments in the EU AI Act to ensure alignment with DORA’s requirements, maintaining operational integrity and trust across its compliance measures.

For more information, please visit here.