Many CISOs are grappling with limited resources, including budgetary constraints and staffing shortages, which hinder their ability to dedicate adequate time and personnel to navigating the complexities of DORA compliance. As a result, there is a need of expert consultancy to ease the process.

CISOs are confronted with the task of managing and classifying vast volumes of sensitive data scattered across disparate systems and platforms to adhere to DORA’s data protection requirements. Security leaders are struggling to identify, classify, and protect sensitive data assets, which is why we are now seeing a shift towards implementing data security posture management solutions to deal with this challenging data problem.

The dynamic nature of cyber threats presents a constant challenge for CISOs tasked with ensuring DORA compliance. As cybercriminal tactics evolve, CISOs must continuously adapt their security strategies, implement proactive threat detection measures, and strengthen incident response capabilities to mitigate the risk of ICT-related incidents and breaches.

Security leaders are often confronted with ambiguous regulatory guidance, making it difficult to interpret DORA’s requirements accurately. Even though we are months away from the implementation of DORA, we see a lack of clear, prescriptive guidelines and standardised frameworks for compliance assessments – there is a lot of room for interpretation, leading to uncertainty and delays in implementation, which is why security and compliance leaders are still finding it challenging to assess readiness.

Many CISOs are challenged with the formidable task of aligning DORA’s specific requirements with their current technological setups. This creates added complexity. They need to find the gaps, address them and manage them while ensuring continuity. Moreover, many organizations rely on outdated infrastructure and applications that lack native support for contemporary security protocols and controls. CISOs face the challenge of retrofitting legacy systems with robust security measures while ensuring seamless interoperability with newer technologies. However, we also see a lot of organisations undergoing a complete ‘revamp’ of their tech stack with a focus on consolidation and simplification.

Organizations rely on a vast network of third-party vendors and service providers to deliver essential ICT services and support business operations. Security leaders encounter challenges in assessing and managing the cybersecurity risks posed by third-party entities, including limited visibility into vendor practices, varying levels of security maturity, and the potential for supply chain disruptions. This is why many organisations are outsourcing their Third Party Security Management (TPSM) to ensure that they can deal with the problem more effectively.