DORA's Second Year: SOC Visibility Crucial for EU Financial Institutions
As DORA enters its second year of enforcement, the focus shifts to practical implementation, highlighting the critical need for Security Operations Centers (SOCs) to achieve continuous visibility across ICT environments to detect and respond to threats.
The Digital Operational Resilience Act (DORA), which became enforceable across the European Union in January 2025, has moved beyond its initial administrative phase. Financial entities spent the first year establishing risk governance, assessing third-party providers, and documenting incident response workflows. Now, in its second year, regulators are intensifying their scrutiny on the practical effectiveness of these frameworks, with a particular emphasis on ICT incident analysis and risk supervision.
This shift places a significant burden on Security Operations Centers (SOCs), demanding they demonstrate sufficient visibility to effectively detect, investigate, and scope active intrusions across critical systems. While DORA does not mandate specific security technologies, its core requirements necessitate continuous monitoring and the ability to identify deviations from normal operational patterns.
Article 9 of DORA mandates that financial entities continuously monitor and manage the security and functioning of their ICT ecosystem. This goes beyond simple asset inventories or configuration records. True continuous monitoring, as required by DORA, involves understanding the flow of communication between systems, especially across legacy infrastructure, specialized appliances, or environments with limited endpoint telemetry. Adversaries often target these blind spots, making comprehensive network visibility essential for disrupting attack chains.
Network Detection and Response (NDR) solutions are emerging as key enablers for meeting DORA's visibility demands. By continuously monitoring network traffic, NDR establishes baselines of normal behavior and identifies anomalies based on timing, volume, and directionality of communications. For instance, an unusual surge in communication from a critical application to unfamiliar internal hosts during off-hours can be detected by NDR, even if the application's own logs remain silent.
Article 10 of DORA requires financial institutions to swiftly detect anomalous activities and establish thresholds for incident response triggers. The sheer volume of security alerts often overwhelms security teams, obscuring genuine threats. NDR plays a crucial role by correlating alerts from disparate sources, such as EDR and identity systems, by analyzing network traffic. This provides the necessary context to determine if a suspicious process or login attempt is part of a larger, coordinated attack, revealing command-and-control traffic, lateral movement, and data exfiltration attempts.
The ability to rapidly investigate incidents is paramount, especially given DORA's stringent reporting timelines. Major ICT-related incidents require initial notification within four hours of classification and within 24 hours of becoming aware of the incident. NDR provides the structured, protocol-level data needed for rapid incident scoping and impact assessment, enabling responders to quickly trace affected systems and isolate threats within these tight deadlines.
Furthermore, DORA's provisions on third-party risk management (Articles 28-30) are also addressed by network visibility. While contracts define authorized access, network data reveals how third-party integrations actually function within the IT environment. Compromised vendor credentials, for example, might lead to legitimate but anomalous network behavior that NDR can detect, prompting critical questions about the scope and nature of the connection that contractual documentation cannot answer.
As financial institutions navigate the second year of DORA, the emphasis is on testing the efficacy of implemented controls. Network visibility, facilitated by NDR, is not merely a technical requirement but a fundamental component for demonstrating compliance with DORA's mandates for continuous monitoring, rapid incident detection, and robust third-party risk management.