5 Practical steps Copla recommends for smooth DORA compliance in Hungary

Sponsored content

The EU’s Digital Operational Resilience Act (DORA) is now in force, applying fully from January 2025. Its aim is to ensure that financial institutions and their service providers across the Union can withstand and recover from disruptions caused by information and communication technologies (ICT). For Hungary, this means that banks, insurers, investment firms, and many intermediaries must be able to demonstrate—not just claim—that they are resilient.

In Hungary, Magyar Nemzeti Bank (MNB) acts as the supervisory authority. MNB has already updated its IT and cloud guidance to align with DORA, which means Hungarian institutions are expected to show maturity in their digital resilience programs. For firms that have already implemented MNB’s recommendations, DORA should not require starting from scratch, but rather integrating, upgrading, and documenting what exists.

Below are Copla’s five practical steps to achieve smooth compliance with DORA in Hungary.

1) Conduct a Gap Assessment and Strengthen Governance

The foundation of DORA compliance is knowing where you stand today. Organizations should map their existing resilience and cybersecurity frameworks to DORA’s five pillars: ICT risk management, incident reporting, resilience testing, third-party risk management, and information sharing. This gap assessment should lead to a prioritized roadmap of remediation actions.

Key tasks:

• Clarify governance. Under DORA, the management body (board or equivalent) must take full responsibility for digital resilience. This should be documented in governance charters, minutes, and KPIs.
• Rationalize policies. Many institutions maintain multiple overlapping IT, security, continuity, and outsourcing policies. DORA offers an opportunity to consolidate these into a clear, tiered structure of policies, standards, procedures, and playbooks.
• Localize compliance. Align your approach with both EU-level requirements and Hungarian supervisory expectations, ensuring MNB’s updated recommendations are fully embedded.

The main deliverable here is a gap-to-target matrix, assigning responsibility and deadlines. This becomes the living document guiding both internal progress and external inspections.

2) Strengthen ICT Risk Management with Accurate Data

DORA elevates ICT risk management to a discipline of its own. Central to this is maintaining a comprehensive and dynamic view of business services, their supporting ICT assets, and interdependencies. Without accurate data, resilience planning is little more than guesswork.

Practical measures:

• Service mapping. Identify your important business services and map them to underlying applications, infrastructure, data stores, people, and suppliers.
• Impact tolerances. Define maximum outage times and acceptable data loss for each important service. Link these tolerances to your risk appetite and remediation strategy.
• Control library. Integrate DORA requirements into your existing control framework (e.g., ISO 27001, NIST CSF) to avoid duplication and maintain one consistent set of controls.
• Registers and inventories. Maintain an up-to-date register of ICT assets and dependencies. This becomes crucial for monitoring risks and demonstrating compliance.

Hungarian institutions already accustomed to MNB’s information security focus will find many of these elements familiar. The difference is now in proving that all registers and mappings are accurate, maintained, and used in risk decisions.

3) Prepare for Major Incident Classification and Reporting

One of the biggest shifts under DORA is the structured requirement for major ICT incident reporting. Financial institutions must be able to classify incidents consistently, escalate them quickly, and report them within tight timelines using standardized templates.

How to prepare:

• Unified severity schema. Develop a harmonized incident severity framework so that all teams (security, IT operations, business continuity) speak the same language when classifying incidents.
• Playbooks for different audiences. Create pre-approved communication templates for MNB reporting, executive updates, customer communication, and supplier escalation.
• Evidence capture. Ensure your IT systems log classification decisions, containment actions, and communication timestamps in a way that can be retrieved for regulatory inspections.
• Post-incident learning. Feed lessons learned into the risk register, track corrective actions, and close findings with documented proof.