Resilience and regulation
Regulators now ask whether important services can keep running through disruption, including disruption at suppliers, and not only whether controls exist. In the UK and EU that means operational resilience rules, DORA and a close look at third-party dependencies.
New to this? The simple version
Field notes
- DORA in practice: what the third-party register reveals
DORA made every EU financial firm list its ICT suppliers in one standard register. The first lesson is not about suppliers at all. It is how hard it is to say which services depend on which contracts.
Tools
- DLP Framework
Includes a legal and regulatory overlay.
Personal work and my own view, not my employer's. Sources are public.