# Digital Operational Resilience Act
Endpoint Central is a trusted solution for financial entities aiming to meet DORA's stringent requirements. With its robust capabilities in ICT risk and incident management, Endpoint Central not only ensures compliance but also enhances your organization’s digital resilience.
| Article | DORA Article - Summary | How Endpoint Central helps |
|---|---|---|
| 6 | **ICT Risk Management Framework**
**1. Purpose and Scope**
- Ensure quick, efficient, and comprehensive handling of ICT risks to achieve high digital operational resilience.
- Protect all information and ICT assets (e.g., software, hardware, data centers, premises) from risks like damage or unauthorized access.
**2. Key Components**
- Include strategies, policies, procedures, ICT protocols, and tools necessary for risk management and asset protection.
- Deploy measures to minimize ICT risk and provide updates on the framework to competent authorities when requested.
**3. Governance and Oversight**
- Assign ICT risk management responsibilities to a control function with adequate independence to avoid conflicts of interest.
- Segregate ICT risk management, control, and audit functions using the three lines of defense model or a similar internal risk management model.
**4. Documentation and Review**
- Document and review the framework at least annually, after major ICT incidents, or upon supervisory requests.
- Continuously improve the framework based on lessons learned and monitoring outcomes.
- Submit review reports to competent authorities when requested.
**5. Internal Audits**
- *Conduct regular internal audits on the framework, performed by skilled and independent auditors.*
- *Audit frequency and focus should align with the financial entity’s ICT risk level.*
- *Establish a formal process for verifying and addressing critical audit findings in a timely manner.*
**6. Digital Operational Resilience Strategy**
- The framework must include a strategy outlining how ICT risk will be addressed and specific objectives achieved, including:
- Aligning ICT risk management with the entity’s business strategy.
- Defining ICT risk tolerance and analyzing disruption impact tolerance.
- Setting information security objectives with performance indicators and risk metrics.
- Explaining ICT reference architecture and required changes.
- Detailing mechanisms to detect, prevent, and protect against ICT-related incidents.
- Assessing resilience through incident reporting and effectiveness of preventive measures.
- Implementing operational resilience testing (as per Chapter IV of the Regulation).
- Defining a communication strategy for reporting ICT-related incidents.
**7. Multi-Vendor Strategy**
- Financial entities may establish a multi-vendor strategy to show key dependencies on ICT third-party providers and justify their procurement choices.
**8. Outsourcing Compliance Tasks**
- Entities may outsource compliance verification tasks to intra-group or external providers but remain fully responsible for ensuring compliance with ICT risk management requirements. | Endpoint Central has comprehensive [reporting capability](https://www.manageengine.com/products/desktop-central/help/reports/desktop-central-reports.html). Apart from providing deep insights about endpoint estate, it can also be used for **governance and auditing purposes.** |
| 7 | **ICT Systems, Protocols, and Tools**
Financial entities must use and maintain updated ICT systems, protocols, and tools to manage ICT risks. These systems must be:
**1. Proportionate to Operations**
- Suitable for the scale and complexity of the entity’s activities, following the proportionality principle (Article 4).
**2. Reliable**
- Dependable for supporting operational and business needs.
**3. Sufficient Capacity**
- Capable of accurately processing necessary data.
- Able to handle peak transaction volumes and accommodate new technology.
**4. Technologically Resilient**
- Equipped to manage additional information processing requirements during stressed market conditions or adverse situations. | Endpoint Central uses FIPS 140-2 compliant algorithms. Users can enable FIPS mode to run their IT in a highly secure environment.
Endpoint Central's multi-tenant, [Summary Server architecture](https://www.manageengine.com/products/desktop-central/summary-server/architecture.html) helps you enroll/onboard more endpoints as your business grows. This architecture is also flexible for organizations with a global presence.
Endpoint Central has multiple third-party software [integrations](https://www.manageengine.com/products/desktop-central/integration.html) to blend into your organization's IT seamlessly. |
| 8 | **Identification**
As part of their ICT risk management framework, financial entities must implement the following measures to identify and manage ICT risks:
**1. ICT Asset and Function Identification**
- Identify, classify, and document all ICT-supported business functions, roles, responsibilities, and their supporting information and ICT assets, including dependencies related to ICT risks.
- Review and update classifications and documentation at least annually or as needed.
**2. Risk and Threat Identification**
- Continuously identify ICT risk sources, including risks from other financial entities.
- Assess cyber threats and vulnerabilities affecting ICT-supported business functions, information assets, and ICT assets.
- Regularly review and update risk scenarios, at least annually.
**3. Risk Assessment for Major Changes**
- Conduct risk assessments after major changes to network and information systems, processes, or procedures affecting ICT-supported business functions, information, or ICT assets.
**4. Critical ICT Asset Mapping**
- Identify and map all ICT and information assets, including remote sites, network resources, and hardware.
- Map configurations, interdependencies, and links between critical assets.
**5. Third-Party Dependency Identification**
- Document all processes dependent on ICT third-party service providers.
- Identify interconnections with providers supporting critical or important functions.
**6. Inventory Management**
- Maintain and periodically update inventories of ICT assets, including after major changes.
**7. Legacy ICT System Assessment**
- Conduct specific ICT risk assessments on legacy systems at least annually and before and after connecting them with new technologies, applications, or systems. | Endpoint Central uses its agents to fetch complete inventory details across your IT environment.
It provides comprehensive vulnerability management with constant assessment and visibility of threats from a single console.
Apart from vulnerability assessment, it also provides built-in remediation of detected vulnerabilities.
Refer to the types of [Inventory scans](https://www.manageengine.com/products/desktop-central/help/inventory/scan_systems_for_inventory.html) leveraged by Endpoint Central for monitoring your IT.
Admins can configure [Inventory Alerts](https://www.manageengine.com/products/desktop-central/help/inventory/configure_email_alerts_for_inventory.html) for unauthorized changes in the IT network.
Endpoint Central can help admins track [high-risk software](https://www.manageengine.com/vulnerability-management/high-risk-software-audit.html) such as outdated software, peer-to-peer software, and insecure remote-sharing software.
The [Custom Group](https://www.manageengine.com/products/desktop-central/help/configuring_desktop_central/creating_custom_groups.html) feature enables logical segregation of critical systems for effective management.
With Network Access Control, admins can quarantine End-of-Life OS systems. |
| 9 | **Protection and Prevention**
Financial entities must implement measures to continuously monitor, control, and minimize ICT risks to ensure the security, resilience, and availability of ICT systems and data. These measures include:
**1. ICT System Monitoring and Control**
- Continuously monitor and control the security and functioning of ICT systems and tools.
- Minimize ICT risks using appropriate security tools, policies, and procedures.
**2. ICT Security Policies and Tools**
- Develop and implement policies, procedures, protocols, and tools to:
- Ensure resilience, continuity, and availability of ICT systems supporting critical functions.
- Maintain high standards for data availability, authenticity, integrity, and confidentiality (at rest, in use, or in transit).
**3. ICT Solutions and Processes**
- Use solutions and processes aligned with proportionality (Article 4) to:
- Secure data transfers.
- Minimize risks of data corruption, loss, unauthorized access, or technical flaws.
- Prevent breaches of availability, authenticity, integrity, and confidentiality.
- Protect data from risks related to poor administration, processing errors, and human mistakes.
**4. Key Components of ICT Risk Management Framework**
- **Information Security Policy:** Define rules to protect data and ICT assets, including customer data.
- **Network and Infrastructure Management:**
- Use automated mechanisms to isolate assets during cyber-attacks.
- Design networks to allow instant severing or segmentation to minimize contagion.
- Access Control Policies: Restrict access to ICT and information assets to legitimate activities.
- Strong Authentication:
- Implement strong authentication based on relevant standards.
- Protect cryptographic keys and ensure encryption based on approved classification and risk assessment.
- **ICT Change Management:**
- Establish risk-based policies for managing ICT changes.
- Ensure changes are documented, tested, approved, and implemented in a controlled manner.
- Have specific protocols approved by appropriate management lines.
- Patch and Update Policies: Develop comprehensive, documented patch and update policies. | Endpoint Central offers endpoint security features such as Endpoint DLP, Browser Security, risk-based vulnerability and patch management, Next-Gen Antivirus, anti-ransomware, and mobile security capabilities.
It provides comprehensive patch support for Windows, Linux, macOS, and Windows Server OS, and patches 1,000+ third-party applications, hardware drivers, and BIOS.
Users can enable [FIPS mode](https://www.manageengine.com/products/desktop-central/help/configuring_desktop_central/fips-compliance.html) for enhanced security.
Admins can encrypt Windows devices using BitLocker Management and Mac devices using FileVault encryption.
Configure [Windows Firewall](https://www.manageengine.com/products/desktop-central/help/computer_configuration/configuring_windows_xp_firewall.html) for endpoints.
Perform a [port audit](https://www.manageengine.com/vulnerability-management/audit-ports-in-use.html) to reduce attack surface.
Enforce [threat protection configurations](https://www.manageengine.com/browser-security/help/threat-prevention-browser-configurations.html) and restrict [file downloads](https://www.manageengine.com/browser-security/download-restriction.html).
Harden web servers and fix [security misconfigurations](https://www.manageengine.com/vulnerability-management/misconfiguration).
Leverage [endpoint privilege management](https://www.manageengine.com/application-control/endpoint-privilege-management.html) and enforce [conditional access policies](https://www.manageengine.com/mobile-device-management/help/profile_management/mdm_conditional_access.html). |
| 10 | **Detection**
Financial entities must implement mechanisms to promptly detect anomalous activities, ICT network performance issues, and ICT-related incidents.
**1. Detection Mechanisms**
- Establish mechanisms to identify anomalies, potential single points of failure, and ICT-related incidents.
- Regularly test these mechanisms as per Article 25.
**2. Multi-Layered Controls**
- Enable multiple layers of control.
- Define alert thresholds and criteria to trigger incident response processes.
- Include automated alert mechanisms for response staff.
**3. Monitoring Resources**
- Allocate sufficient resources to monitor user activity, ICT anomalies, and cyber-attacks.
**4. Data Reporting Service Providers**
- Verify completeness of trade reports.
- Identify omissions or errors and request re-transmission if required. | In case of a [malware attack](https://www.manageengine.com/products/desktop-central/nextgen-antivirus.html), Endpoint Central alerts SOC teams and enables safe quarantine.
It protects endpoints [against ransomware](https://www.manageengine.com/products/desktop-central/anti-ransomware.html) and provides instant, non-erasable backups every three hours using Microsoft Volume Shadow Copy Service.
Infected files can be restored from the most recent backup copy. |
| 11 | **Response and Recovery**
Includes ICT business continuity policies, implementation procedures, response and recovery plans, business impact analysis (BIA), testing, crisis management, record-keeping, and reporting obligations.
Entities must:
- Ensure continuity of critical functions.
- Activate containment and recovery measures.
- Conduct annual testing including cyber-attack scenarios.
- Maintain records and report major ICT incidents as required.
- Align with ESA guidelines for estimating losses. | Endpoint Central guards endpoints against ransomware and provides instant, non-erasable backups.
Endpoints exhibiting suspicious behavior can be quarantined and restored after forensic analysis.
Integrates with SIEM tools such as Rapid7, Splunk, and EventLog Analyzer. |
| 12 | **Backup Policies, Restoration, and Recovery Procedures**
Entities must establish backup policies, restoration methods, redundant ICT capacities, and secure secondary processing sites (where applicable).
They must define recovery time and recovery point objectives, perform data integrity checks, and test restoration procedures periodically. | Endpoint Central provides ransomware protection and non-erasable backups every three hours using Microsoft Volume Shadow Copy Service.
Supports endpoint quarantine and secure restoration processes. |
| 15 | **Further Harmonisation of ICT Risk Management Tools, Methods, Processes, and Policies**
ESAs will develop Regulatory Technical Standards (RTS) to strengthen ICT security policies, access controls, anomaly detection, business continuity testing, and reporting standards.
Draft RTS to be submitted to the European Commission by 17 January 2024. | Endpoint Central helps organizations comply with *RTS (Regulatory Technical Standards) on ICT risk management tools, methods, processes, and policies*.
Provides ransomware protection, FIPS 140-2 compliant algorithms, encryption support, endpoint privilege management, and [conditional access policies](https://www.manageengine.com/mobile-device-management/help/profile_management/mdm_conditional_access.html). |
| 16 | **Simplified ICT Risk Management Framework**
Applicable to certain small or exempted entities.
Requires documented ICT risk frameworks, continuous monitoring, resilience measures, incident handling, third-party dependency identification, business continuity planning, testing, review, and reporting.
ESAs to develop RTS specifying additional elements and testing rules. | Endpoint Central supports compliance with RTS and the simplified ICT risk management framework, including Articles 30 to 38 of the RTS. |
| 17 | **ICT-Related Incident Management Process**
Entities must define processes to monitor, classify, log, and respond to ICT-related incidents.
Key elements include:
- Early warning indicators.
- Incident classification aligned with Article 18(1).
- Defined roles and responsibilities.
- Communication plans for stakeholders and authorities.
- Senior management reporting.
- Response procedures to mitigate impacts and restore services securely. | In case of a suspicious event, the following details are sent to the Network Administrator/SOC team:
**Attack Details:**
- Detection Time
- Reported Time
- Attack Status
- Agent Action
- Attack Criticality (Low/Medium/High)
- Detection Source (Behaviour Engine)
- Image Path
- Process Name
- SHA256
- Command
**Endpoint Details:**
- Endpoint Name
- Domain Name
- Endpoint Status
- Endpoint Version
- Activated Time
- Last Contact Time |