Stress-Testing Cyber Resilience under DORA
Preparing Global Financial Firms for Ransomware and Data Breach Regulations
Jake Vollebregt, Partner, Quadrant Law Group, LLP
EXECUTIVE SUMMARY
- Resilience—the ability to recover and restore operations after a disruption—is the emerging cybersecurity standard for the financial system.
- U.S. and EU regulators are implementing new frameworks that prioritize resilience over prescriptive technical requirements.
- Under DORA, ICT vendors who provide critical services to European financial entities are now held to a new set of cybersecurity standards.
- Stress-testing critical ICT services and rehearsing incident response plans are likely to become key indicators in regulatory examinations.
Banks, broker-dealers, investment advisers, and asset managers face a relentless barrage of cyberattacks and sensitive data breaches. To protect the financial system from these threats, U.S. and EU regulators have steadily introduced new rules for managing sensitive data and third-party ICT services, the latter of which currently represent weak links in the financial system. These rules are aimed at promoting resilience, the new and critical benchmark for cybersecurity. Resilience standards require financial entities to not only prevent and respond to cyber threats, but also to ensure rapid recovery of critical operations through scenario-based testing and adaptive risk management frameworks.
“Resilience standards require financial entities to not only prevent and respond to cyber threats, but also to ensure rapid recovery of critical operations through scenario-based testing and adaptive risk management frameworks.”
The Shifting Cybersecurity Landscape
Once solely the concern of IT departments and management teams, cyberattacks have escalated to the point of becoming standing boardroom priorities and persistent risks to the banking and finance industries. In 2024, the FBI’s Internet Crime Complaint Center (IC3) registered 67 new ransomware variants, including FOG, Lynx, Cicada 3301, DragonForce, and Frag, and reported $16.6 billion in losses occurred due to internet crime, a 33% increase from 2023.1 Among the major targets of recent ransomware attacks are banking and finance firms such as loanDepot, Patelco Credit Union, Prudential, Bank of America, EquiLend, and Evolve Bank & Trust.2 The following are a few examples of other recent cyber incidents:
- In November 2023, Bank of America’s ICT vendor InfoSys McCamish Systems experienced a ransomware attack, resulting in the breach of 57,000 customers’ sensitive personal data and account information.
- In July 2024, CrowdStrike rolled out a software update containing a serious flaw that disrupted critical operations across multiple economic sectors, causing an estimated $1.29 billion in losses to Fortune 500 companies in the banking and finance industry (approximately $71.84 million per company).
- In January 2025, a threat actor exploited a vulnerability affecting Oracle Fusion Middleware and Oracle Access Manager,5 accessed the production environments of Oracle’s Cloud Classic (Gen1), and subsequently exfiltrated 6 million records containing sensitive data affecting 140,000 tenants.
- In April 2025, the Office of the Comptroller of the Currency (OCC) notified Congress that it identified a major incident involving a breach of the OCC’s Microsoft e-mail system.
These incidents jeopardize the sensitive data of millions of customers and employees, create legal risks; prompt regulatory action; and cause reputational fallout. Regulators are responding to the growing frequency and complexity of disruptions by adopting new standards for ICT services and stepping up enforcement actions.
Prioritizing Resilience for Global Financial Entities
Until recently, technical tools, defense measures, and risk management frameworks were prescribed as the first line in defending against cyberattacks and preventing data breaches. For example, firewalls, encryption, multifactor authentication, and rapid patch updates are all essential defenses. As cloud services and innovative technologies become standard in the rapidly evolving technology and finance sectors, regulators have determined that traditional cybersecurity approaches are no longer sufficient.
Instead of prescribing an ever-evolving set of technical tools and defensive measures in response to ICT incidents, regulators in both Europe and the United States have adopted resilience—the ability to restore operations quickly after a disruption—as the new cybersecurity standard. As a result, financial entities are now expected to prioritize resilience to avoid crippling losses, maintain customer trust, and meet the expectations of auditors and regulators.
“A Lead Overseer can even take action against ICT vendors located outside the EU by auditing and inspecting facilities and property used to deliver the ICT vendor’s services within the EU’s jurisdiction.”
EU Resilience Standards under DORA
To shift to a resilience-focused approach the European Council adopted the Digital Operational Resilience Act (Regulation (EU) 2022/2554) (DORA), which became enforceable on January 17, 2025. The Act provides European financial entities with a roadmap for resilience-focused contract provisions with their ICT vendors. It also requires European financial entities, including the European affiliates of non-EU entities, to establish and maintain comprehensive risk management, periodic stress testing, rapid incident reporting, and oversight of their ICT vendors.
Enforcement of DORA
DORA’s enforcement is delegated to the European Supervisory Authorities (ESAs), which include each financial sector’s respective regulator. These are the European Banking Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA), and the European Securities and Markets Authority (ESMA).8 DORA grants broad enforcement powers to ESAs and National Competent Authorities (NCAs). NCAs include BaFin, ACPR, and Banc D’Italia. DORA authorizes competent authorities to investigate, audit, prescribe remediation, and impose penalties on regulated financial entities and critical ICT vendors. For example, ESAs can audit a financial entity’s ICT service agreements for information security requirements, service levels, use of subcontractors, service locations, security training, and penetration testing.
Among other things, financial entities have begun assembling and submitting registers of information to ESAs and NCAs to support monitoring and supervision and incorporating DORA into their internal and external audits in preparation for the close of the fiscal year. ESAs will review financial entities’ registers of information to identify systemic dependencies and assess the impact a service outage would have on Europe’s financial system. ESAs will then use these assessments to designate critical ICT vendors and establish oversight programs.
Regulation of Critical ICT Vendors
An ESA can be designated as “Lead Overseer” over a critical ICT vendor. As Lead Overseer, the ESA has additional powers to investigate, inspect, and require cooperation from a critical ICT vendor directly. A Lead Overseer can even take action against ICT vendors located outside the EU by auditing and inspecting facilities and property used to deliver the ICT vendor’s services within the EU’s jurisdiction. Non-compliant ICT vendors are subject to periodic penalty payments of up to 1% of the average daily worldwide turnover calculated based on the ICT vendor’s prior fiscal year. These fines can be imposed on a daily basis for up to six months until compliance is achieved.
When does DORA apply?
Since DORA’s enactment, financial entities and their ICT vendors have been creating business processes for ongoing compliance. Financial entities are required to submit registers of information (a prescribed format) with information about their use of ICT services. Financial entities that operate in the European Union can use the following screening questions to assist the business, contracting and procurement staff, and legal reviewers in determining whether DORA applies and which clauses are needed:
1. Is this an ICT service?
“Does this engagement include any information or communication technology services?”
To identify in-scope ICT services, the business, with support from the financial entity’s contracting and legal teams, can evaluate the service with the following questions:
- Does the service involve the transmission, hosting, or processing of data?
- Does it rely on computer software or hardware?
- Is the service accessed by the financial entity’s users via the cloud or other electronic networks?
- Could an outage or breach of servers or other digital components impact the financial entity’s affiliates, customers, or operations?
2. Is this ICT Service subject to DORA?
“Will the ICT service support the financial entity’s business activities in Europe?”
The financial entity’s subject matter experts (SMEs) can use the following questions to evaluate whether the ICT service is subject to the EU’s jurisdiction and regulatory supervision:
- Does the data relate to the financial entity’s European customers?
- Would a breach or outage affect the firm’s European operations or the EU’s financial system?
- Do employees of a European financial entity or an affiliate use the service?
If the ICT service is subject to DORA, the financial entity will need to incorporate clauses under Article 30(2). As other jurisdictions continue adopt similar resilience standards, establishing a nexus to the EU will become less relevant.
3. Does this ICT service support CIF?
“Does the ICT service materially underpin one of the financial entity’s critical or important functions (CIF)?”
The financial entity can use the following questions to evaluate the ICT service’s materiality and whether it is CIF-supportive:
- Is the service essential to day-to-day operations of the firm or one of its core businesses?
- Do the financial entity’s customers directly interact with the service?
- Does the service process sensitive information, such as confidential information belonging to the financial entity or sensitive personal information of its customers?
- Could a breach or outage of electronic/information components disrupt the financial entity’s business operations?
- Could the financial entity continue normal operations if the service faced a breach or outage?
CIF-supportive ICT services need to be reported in the financial entities register of information and brought into compliance with DORA Article 30(3).
The questions above can elicit dialogue and leverage cross-functional expertise (business, security, privacy, legal, etc.) to evaluate and categorize services. Over time, this will help develop internal processes and controls for the ICT services and the types of data they process. This practice also supports reporting obligations, such as the financial entity’s register of information, audits, and examinations. ESAs will use this information to identify critical ICT services.
DORA Remediation and Contract Uplift
DORA prescribes contract provisions with ICT vendors and specific administrative and technical standards for resilience against cyber incidents. Consequently, financial entities are engaging in a two-pronged effort to comply with DORA. First, they are reviewing their ICT service agreements and negotiating amendments with the ICT vendors where necessary. Second, they are establishing new processes and controls to ensure their ICT services comply with DORA. Proactive vendor outreach, market-standard contract templates, and a structured screening process will help achieve compliance and minimize operational friction. The Act requires Europe’s financial entities and their ICT vendors to include specified topics in their service agreements:
DORA Contract Standards
Applicable to all ICT Services:
1. Detailed Service Description - Art. 30(2)(a)
2. Data Processing Locations - Art. 30(2)(b)
3. Data Protection - Art. 30(2)(c)
4. Data Access and Recovery - Art. 30(2)(d)
5. Service Level Agreements (SLAs) - Art. 30(2)(e)
6. Incident Response - Art. 30(2)(f)
7. Cooperation with Authorities - Art. 30(2)(g)
8. Enhanced Termination Rights - Art. 30(2)(h)
9. Training Program Participation - Art. 30(2)(i)
Additional Requirements
for CIF-Supportive ICT Services:
10. Subcontracting - Art. 30(2)(a)
11. Enhanced SLAs - Art. 30(3)(a)
12. Notice and Reporting - Art. 30(3)(b)
13. Contingency and Security Measures - Art. 30(3)(c)
14. Threat-Led Penetration Testing - Art. 30(3)(d)
15. Monitoring, Audit, and Cooperation - Art. 30(3)(e)
16. Exit Strategies - Art. 30(3)(f)
For CIF-supportive ICT services, DORA prescribes additional protections, such as subcontractor risk management, penetration testing, audit rights, and transition planning. Financial entities can balance thoroughness and efficiency by embedding resilience standards into their vendor agreement templates, onboarding questionnaires, and service evaluations. If a vendor’s standard service agreements lack resilience clauses required by DORA, financial entities will be expected to incorporate standard contractual clauses developed by public authorities14 or otherwise approved by legal counsel.
U.S. Resilience Standards
Similar to their European counterparts, U.S. authorities like the OCC, the Federal Reserve Board (FRB), the Federal Deposit Insurance Corporation (FDIC), the Federal Financial Institutions Examination Council (FFIEC), the Securities and Exchange Commission (SEC), and Financial Industry National Regulatory Authority (FINRA) have gradually transitioned from a risk-based approach to resilience-focused guidance and enforcement standards for the U.S. financial system. The FFIEC is a U.S. interagency body representing the FRB, FDIC, OCC, National Credit Union Administration (NCUA), Consumer Financial Protection Bureau (CFPB), and other regulators in maintaining examination standards and guidance for banks and depository institutions.
Here are some examples of how U.S. regulators are prioritizing digital resilience:
Operational Resilience
- In 2020, the OCC, FRB, and FDIC issued an interagency paper on standards for operational resilience for U.S. banks, including effective governance, information security, and reporting obligations.16 The paper reflects on disruptive technology failures arising from third-party ICT vendors. Rather than prescribing specific measures to minimize disruptions altogether, the paper prioritizes operational resilience as an approach to manage cyber risks by mitigating the adverse effects of disruptions and recovering as quickly as possible.
- In 2023, the SEC reopened comments for proposed new rules requiring investment firms to implement policies and procedures for mitigating and disclosing cyber risks.
- The Cybersecurity and Infrastructure Security Agency (CISA) is preparing sector-specific goals for the financial services industry and expects to publish in late 2025.
The FFIEC has adopted several cyber resilience measures for supply chain management into its examination handbooks. For depository institutions, this is outlined in the FFIEC’s 2020 interagency paper, “Sound Practices to Strengthen Operational Resilience.”15 Like DORA, these standards emphasize proactive testing and recovery to prepare financial entities and their ICT vendors to respond to and recover from ransomware attacks, data breaches, and service outages.
“Like DORA, these standards emphasize proactive testing and recovery to prepare financial entities and their ICT vendors to respond to and recover from ransomware attacks, data breaches, and service outages.”
ICT Vendor Management
“This data enables FINRA to identify systemic interdependencies among critical ICT vendors and evaluate whether these dependencies impede its ability to effectively supervise its members.”
- In 2015, FINRA noted the rising prevalence among financial service providers of relying on ICT vendors to process sensitive information and highlighted the importance of exercising strong due diligence across the lifecycle of vendor relationships.19
- In 2023, FINRA issued a questionnaire regarding its members’ use of ICT vendors, generative artificial intelligence (AI), and large language models.20 This data enables FINRA to identify systemic interdependencies among critical ICT vendors and evaluate whether these dependencies impede its ability to effectively supervise its members.
- In 2023, the SEC proposed a set of updates to Regulation Systems Compliance and Integrity (Reg SCI).21 Reg SCI originally took effect in 2015 to strengthen the technology infrastructure of exchanges, clearing agencies, and alternative trading platforms (SCI entities).22 The proposed changes—which large broker-dealers and cloud service providers generally oppose—expand Reg SCI’s scope to include large broker-dealers, require SCI entities to manage and oversee ICT vendors, and to maintain business continuity and disaster recovery testing requirements.23 While Reg SCI focuses on SCI entities, it also affects banks, fintechs, and ICT vendors who rely on these systems for trading and settlement.
- In 2024, the SEC published updates to Reg S-P, which require financial entities to ensure their ICT vendors have adequate controls to protect customer information, an incident response plan for breaches or vulnerabilities, and audit rights to ensure compliance. Depending on their size, financial entities have a compliance period of 18 to 24 months following August 2024 in order to implement the new requirements.
Information Security
- In 2021, the SEC imposed fines on several broker-dealers and advisers for violating Safeguards Rule 30(a) of Reg S-P and issuing misleading breach notifications to their clients.24 Reg S-P was adopted in 2000 as an implementation of the Gramm-Leach-Bliley Act, which requires financial entities to safeguard customers’ nonpublic information. The SEC found that the financial entities failed to implement adequate policies and security measures, including multifactor authentication for e-mail accounts, between 2017 and 2021. As a result of these failures, more than 10,000 customers’ sensitive personal information was compromised.
Inspection and Audit
- In 2022, the SEC updated Rule 17a-4 to permit audit-trail systems on modern cloud-based databases. The longstanding Rule 17a-4 requires broker-dealers to preserve all records for a period of 6 years, and to make them easily accessible for review and regulatory audit.27 Subsection (f)(3)(vii) allows broker-dealers to maintain records electronically with banks and ICT vendors, and requires regulators to have direct access to records upon request. If the bank or ICT vendor fails to either preserve or produce records during an audit, the broker-dealer could face penalties. This rule indirectly causes other entities to align with SEC standards, especially when a ransomware attacks compromise security and the ICT vendor agreement accounts for these obligations, which promotes third-party resilience.
- In 2023, the FRB, OCC, and FDIC issued new guidance on managing third-party vendor risks.28 This guidance requires financial entities to incorporate contract provisions—where appropriate according to the risk and complexity of the ICT service—entitling them to periodic, independent audits of the ICT vendor and its relevant subcontractors. Therefore, contracts should describe the types and frequency of audit reports the financial entity is entitled to receive from the ICT vendor (for example, SOC reports, Payment Card Industry [PCI] compliance reports, or other financial and operational reviews). Such contract provisions may also reserve the banking organization’s right to conduct its own audits of the ICT vendor’s systems, subcontractors, and processes.
“Therefore, contracts should describe the types and frequency of audit reports the financial entity is entitled to receive from the ICT vendor (for example, SOC reports, Payment Card Industry (PCI) compliance reports, or other financial and operational reviews).”
Business Continuity
- In 2022, FINRA issued a Regulatory Notice acknowledging the proliferation of increasingly complex and sophisticated ransomware incidents.29 The notice urged financial entities to evaluate and test their ICT vendors’ cybersecurity controls and ability to protect sensitive data. Regulatory Notice 22-29 noted that disruptions and outages caused by ransomware are subject to FINRA Rule 4370’s requirements for Business Continuity Plans, and that ransomware payments could implicate sanctions and anti-money laundering (AML) violations.
- In its 2025 FINRA Annual Regulatory Oversight Report, FINRA noted the increase in ransomware attacks and outages affecting ICT vendors and reiterated financial entities’ obligations to monitor and supervise their ICT vendors. 30 The report offered best practices for developing third-party risk management programs and processes for ICT vendors and acknowledged emerging AI risks and trends. To illustrate, the report cites FINRA Rules 3110 and 4370, which require broker-dealers to establish supervisory compliance and risk management systems, maintain business continuity plans to account for disruptions to operations, and monitor critical third-party dependencies.
The initial examples of recent cyberattacks given above, particularly the Bank of America ICT vendor breach in 2023 and SEC enforcement for e-mail breaches in 2021, affect financial entities and ICT vendors who would not ordinarily be subject to direct regulatory oversight. By implementing rules like the Computer-Security Incident Notification Rule, Rule 17a-4, Reg SCI, Reg S-P, and FINRA Rules 3310, 4370, and 4511, U.S. regulators follow a third-party oversight model similar to DORA by holding financial entities accountable for their ICT vulnerabilities and failures.
Below are some additional theoretical scenarios where an ICT vendor’s failures can have detrimental effects on financial entities and their compliance with a variety of regulatory standards, which—again—demonstrate the need for systemic resilience:
- A data breach that corrupts customer data or a ransomware attack that freezes transaction records at a bank could hinder a broker-dealer’s AML monitoring, leading to scrutiny under FINRA Rule 3310.
- A data breach or ransomware attack that disrupts a bank’s interface with an SCI entity and has market-wide implications could prompt SEC scrutiny of the bank’s cybersecurity practices under broader fiduciary or operational risk management principles.
- If a ransomware attack on a bank disrupts a broker-dealer’s ability to process transactions, then the broker-dealer could be investigated under FINRA Rule 4370 and may face legal or contractual fallout for failing to support continuity. This, in turn, could indirectly call upon other financial entities and their ICT vendors to bolster resilience for FINRA members.
- If a bank, fintech, or ICT vendor processes customer data for a financial entity, then a breach could trigger notification and remediation obligations for the financial entity. For example, if the broker-dealer fails to comply with Reg S-P, then a ransomware attack on a bank’s systems hosting broker-dealer data could lead to both SEC enforcement and FINRA penalties. Other financial entities could be implicated by cybersecurity, recordkeeping, and AML rules intended to manage ransomware and data breach risks. ICT vendors could face legal and reputational risk if their contracts do not account for responding to ransomware attacks, outages, and regulatory inquiries.
- FINRA Rule 4511 (Books and Records) requires broker-dealers to maintain and preserve records as an application of SEC rules (e.g., Rule 17a-3 and 17a-4). If an ICT vendor stores books and records for a financial entity subject to FINRA Rule 4511 and suffers a ransomware attack or breach, then the broker-dealer could be considered non-compliant. This creates a ripple effect, pressuring other institutions to adopt cybersecurity measures compatible with FINRA regulations. A bank’s failure to protect records could lead to fines and other legal and regulatory risks for the broker-dealer.
These examples highlight the cascading effects of third-party vulnerabilities, reinforcing the need for robust ICT vendor oversight and proactive resilience testing. Ransomware and data breaches can trigger compliance failures downstream and affect the broader financial system. This may prompt U.S. policymakers to copy a page from DORA by regulating critical ICT vendors directly.
Evolving Regulatory Standards
Moving forward in parallel with the advent of DORA’s enforcement, the OCC, FDIC, FRB, FFIEC, SEC, and FINRA are likely to implement several of their own regulatory updates soon and will likely include the following:
- Mandatory Resilience Stress testing: Financial entities will be expected to perform resilience stress testing to evaluate their readiness for ransomware attacks and data breaches. DORA requires scenario-based testing, such as ransomware lockdowns or data exfiltration simulations.32 The FFIEC is likely to require banks to use similar exercises for testing recovery from encrypted systems or breached databases. These tests would assess backup integrity, response times, and continuity plans, thereby shifting focus from static audits to dynamic resilience.33 The outcomes of these rehearsals will inform financial entities when they negotiate their agreements with ICT vendors and will affect how ICT vendors compete for their business.
- Enhanced Third-Party Risk Management: The EU’s oversight of financial entities’ use of ICT services is necessary because they are prime targets for cyberattacks and data breaches. U.S. regulators will likely expand existing guidance, mandating ransomware-specific due diligence, malicious code warranties, and contractual recovery guarantees from cloud providers and payment processors.
- Prompt Incident Reporting and Recovery Standards: Building on the FDIC’s 36-hour rule, regulators may adopt DORA’s detailed incident classification, requiring banks to report ransomware or breach impacts on critical operations within hours and to adhere to phased notice and recovery timelines in their SLAs (e.g., immediate notification upon discovery, data restoration within 48 hours, and root cause analysis within 30 days).
- Sector-Wide Threat Intelligence Sharing: DORA encourages voluntary data sharing to boost collective resilience. The OCC and FDIC are likely to examine current practices for monitoring, reporting, and sharing anonymized ransomware tactics or breach patterns to strengthen industry-wide defenses. Industry groups like Financial Services Information Sharing Analysis Center (FS-ISAC) can serve as clearinghouses for this information.
Getting Ahead of the Curve
Financial entities that can resolve disruptions resiliently can avoid crippling losses and retain their customers’ trust. To adapt to a resilience framework, financial entities and ICT vendors can incorporate the following practices into their risk management programs and contract negotiation standards:
“The FFIEC recognizes tabletop exercises, limited-scale exercises, and full-scale exercises as valid methods for testing continuity and resilience. CISA and FS-ISAC provide tabletop exercise packages with plausible financial industry scenarios.”
- Include Resilience Clauses in ICT Agreements: New ICT services and renewals may require specific provisions. This requires working proactively with ICT vendors to incorporate DORA-compliant clauses and other applicable regulatory obligations. Critical ICT services will need additional protections, such as CIF-supportive provisions under DORA Article 30(3).
- Conduct Stress Tests: Engage cross-functional teams to simulate a ransomware attack that is encrypting core systems or a breach that gains access to customer data to test recovery using offline backups. Coordinate tabletop exercises and rehearsals with crisis management teams. The FFIEC recognizes tabletop exercises, limited-scale exercises, and full-scale exercises as valid methods for testing continuity and resilience.35 The Cybersecurity and Infrastructure Security Agency (CISA)36 and FS-ISAC provide tabletop exercise packages with plausible financial industry scenarios.37
- Update Recovery Plans: Use stress test findings to revise standard procedures and checklists. Define and update ransomware-specific contingencies (e.g., alternative workflows) during outages and breach response protocols, checklists, and notification timelines for customers, data subjects, and government authorities.
- Assess Third Parties: Audit vendors for resilience capabilities based on the criticality of the supported operations and the volume and sensitivity of the data they process. This will ensure that the appropriate scrutiny is applied and that contracts do not impose excessive obligations on ICT vendors.
These efforts will aim to deliver advantages by reducing the impact of ransomware attacks and disruptions, as well as fulfilling the expectations of regulators and customers.
Conclusion
Cyberattacks and data breaches along with gaps and failures in ICT vendor systems can disrupt financial entities and undermine consumer trust in the financial system. As a result, financial entities and ICT vendors face growing pressure to comply with OCC, FDIC, FRB, FFIEC, SEC, and FINRA regulations and guidelines, which—much like the EU’s DORA—seek to make stress testing the cornerstone of cybersecurity vigilance in the United States. Technology, legal, compliance, and risk management leaders who prioritize resilience as a competitive edge beyond meeting a minimum standard will empower their firms to succeed in a digital world.
For additional information, please contact:
Jake Vollebregt, Partner
Quadrant Law Group, LLP
This Bulletin is provided for informational and educational purposes only. It does not constitute legal advice or establish an attorney-client relationship. This Bulletin may be considered attorney advertising in some states.
Quadrant Law Group, LLP © 2026. All rights reserved. 203 N. La Salle St. Suite 2100, Chicago, IL 60601
