The DORA Compliance Gap: Why Most Irish SME Suppliers Are Not Ready.

For Irish SME suppliers to the financial sector, across Donegal, Sligo, Dublin, and Ireland.

Did you know that your financial sector client's deadline for DORA compliance is also, effectively, your deadline?

The Digital Operational Resilience Act (DORA) is a new EU regulation designed to bolster the cybersecurity and operational resilience of the financial sector. It mandates that financial entities, from banks to investment firms, ensure their critical third-party ICT providers also meet stringent resilience standards. This means if your SME supplies services to a financial institution in Ireland, DORA directly impacts you, whether you've heard of it or not.

The clock is ticking for financial entities to comply by January 2025, and their reliance on your services means your readiness is paramount. The Central Bank of Ireland has been clear that financial firms must identify and manage risks stemming from their third-party providers, extending the regulatory gaze far beyond their own walls. This creates a significant, often unrecognised, compliance gap for many Irish SME suppliers.

The Unseen Challenge for Irish SME Suppliers

Many small and medium-sized enterprises (SMEs) in Ireland, particularly those providing IT, cloud, or data processing services to the financial sector, are operating in the dark regarding DORA. They may have robust internal security practices, but these might not align with DORA's specific requirements for operational resilience. This oversight isn't just a minor administrative hurdle; it's a potential business continuity crisis.

The consequences of non-compliance for a financial institution can be severe, including hefty fines and reputational damage. When their clients face such risks, they will inevitably pass these requirements down the supply chain. If you are a supplier to a financial entity, their deadline is your deadline, and failure to meet it could jeopardise your contracts and future business opportunities. The National Cyber Security Centre (NCSC) Ireland consistently highlights the interconnectedness of cyber risk, underscoring that a weakness in one part of the supply chain can compromise the entire ecosystem.

Consider a regional credit union in Sligo, for example, relying on a local IT provider for its core banking software. If that IT provider hasn't begun to assess its operational resilience against DORA's mandates, the credit union's own compliance efforts are fundamentally undermined. This scenario is playing out across Ireland, creating a silent, yet significant, vulnerability in the financial supply chain. Understanding DORA is the first step towards securing your position and your clients' resilience.

Five Common DORA Compliance Gaps for SMEs

For many Irish SME suppliers, DORA introduces new layers of scrutiny that go beyond traditional data protection or cybersecurity audits. Identifying these gaps early is crucial for developing a targeted remediation plan. Here are five of the most common areas where SMEs fall short, acting like cracks in a dam that could lead to a flood of regulatory issues.

1. Lack of a Comprehensive ICT Risk Management Framework: DORA requires a robust framework for identifying, classifying, managing, and reporting ICT risks. Many SMEs have informal processes, but lack the formal, documented, and regularly reviewed framework demanded by DORA. This framework must cover all ICT assets, processes, and dependencies, including those managed by sub-contractors.

2. Inadequate Digital Operational Resilience Testing: Financial entities must conduct regular, advanced testing of their operational resilience, including scenario-based testing and penetration testing. As critical third parties, SME suppliers will be expected to participate in or conduct similar tests. Many SMEs lack the resources or expertise to perform such sophisticated testing, leaving them unprepared for their clients' demands.

3. Insufficient ICT Third-Party Risk Management: While financial entities are primarily responsible for managing their third-party risks, DORA also places obligations on critical ICT third-party providers. This includes providing clear information on their operational resilience capabilities and cooperating with audits. SMEs often lack the structured processes to provide this level of transparency and assurance to their financial clients.

4. Absence of a Detailed ICT Incident Management and Reporting Process: DORA mandates strict requirements for managing and reporting ICT-related incidents, including cyberattacks. This involves clear classification, rapid response, and timely notification to financial entities and, where applicable, regulators. Many SMEs have incident response plans, but they may not meet DORA's specific timelines and reporting granularity, especially concerning cross-border implications.

5. Lack of a Business Continuity and Disaster Recovery Plan Specific to DORA: While most businesses have some form of business continuity planning, DORA requires these plans to be specifically tailored to ensure the continuity of critical functions provided to financial entities. This includes clear recovery time objectives (RTOs) and recovery point objectives (RPOs) that align with the financial sector's stringent requirements. Many SME plans are too generic or lack the necessary detail.

Not sure where your business stands on cyber risk? Download the Irish SME Cyber Survival Guide — a free, plain-English guide to the 10 controls every Irish business needs. No jargon, no sales pitch.

Where does your security stand? Take our free Security Maturity Assessment to find out.

Bridging the Gap: Quick Wins for DORA Compliance

Closing these DORA compliance gaps doesn't have to be an overwhelming task. Strategic, focused efforts can yield significant progress quickly. The key is to approach DORA not as a burden, but as an opportunity to strengthen your operational resilience and solidify your relationships with financial sector clients. Proactive engagement now can prevent costly disruptions and demonstrate your commitment to security and reliability.

Here’s how to address the common gaps efficiently:

def calculate_dora_risk_score(ict_risk_management_maturity, resilience_testing_frequency, third_party_oversight_strength, incident_response_efficiency, bcdr_plan_robustness): # Map qualitative inputs to numerical scores (e.g., 1-5) scores = { 'low': 1, 'medium': 3, 'high': 5, 'very low': 1, 'moderate': 3, 'strong': 5, 'excellent': 5, 'poor': 1, 'fair': 2, 'good': 4 }

# Convert inputs to numerical scores
ict_score = scores.get(ict_risk_management_maturity.lower(), 0)
resilience_score = scores.get(resilience_testing_frequency.lower(), 0)
third_party_score = scores.get(third_party_oversight_strength.lower(), 0)
incident_score = scores.get(incident_response_efficiency.lower(), 0)
bcdr_score = scores.get(bcdr_plan_robustness.lower(), 0)

# Simple weighted average for demonstration. Weights can be adjusted based on DORA's emphasis.
# For DORA, all these factors are critical, so equal weighting is a reasonable starting point.
total_score = (ict_score + resilience_score + third_party_score + incident_score + bcdr_score) / 5

# Normalize to a 1-10 scale for easier interpretation
normalized_score = (total_score / 5) * 10

return round(normalized_score, 2)

Example Usage:

Assuming an SME has:

- ICT Risk Management Maturity: 'medium'

- Resilience Testing Frequency: 'low'

- Third-Party Oversight Strength: 'fair'

- Incident Response Efficiency: 'good'

- BCDR Plan Robustness: 'moderate'

dora_score = calculate_dora_risk_score('medium', 'low', 'fair', 'good', 'moderate')

print(f"Calculated DORA Risk Score: {dora_score}")

This function is illustrative and would need actual DORA requirements and a more sophisticated scoring model.

This Python function, `calculate_dora_risk_score`, provides a simplified, illustrative method for an SME to assess its DORA compliance posture. It takes qualitative inputs for key DORA areas and converts them into a numerical score, offering a preliminary indication of readiness. While this is a simplified model, it demonstrates how a more complex, DORA-specific scoring mechanism could be developed to help SMEs identify their risk level and prioritise areas for improvement. For a comprehensive assessment, SMEs should consult official DORA guidelines and engage with cybersecurity experts.



**[Book a free 20-minute strategy call](/book-a-call)** with our vCISO team. No sales pitch. No jargon. Just clarity on your cyber risk.

## Related Reading

- [DORA vs NIS2: What Is the Difference and Which One Applies to Your Business?](/blog/dora-vs-nis2-difference-which-applies-your-business)
- [Director Liability in the Age of NIS2 and GDPR: A Briefing for Irish Company Directors](/blog/director-liability-nis2-gdpr-briefing-irish-company-directors)
- [Demystifying Cyber Insurance: What Irish SMEs Need to Know Before Buying](/blog/demystifying-cyber-insurance-what-irish-smes-need-to-know-before-buying)

[^1]: [NCSC Ireland — Advice for Organisations](https://www.ncsc.gov.ie/advice-for-organisations/)
[^2]: [An Garda Síochána — Cyber Crime](https://www.garda.ie/en/crime/cyber-crime/)
[^3]: [Data Protection Commission Ireland](https://www.dataprotection.ie)

Pragmatic Security — Cybersecurity advisory for Irish businesses. Based in Donegal, Ireland. CISA, CISSP, CISM certified advisors.