Cloud computing has become essential for financial institutions, but DORA introduces specific requirements for cloud service usage. This comprehensive guide covers everything you need to know.

DORA's Approach to Cloud Services

DORA doesn't prohibit cloud usage but requires:

  • Enhanced due diligence on cloud providers
  • Specific contractual clauses
  • Risk assessment of cloud dependencies
  • Concentration risk management
  • Exit strategies and data portability

Cloud Providers as Critical Third Parties

Direct EU Oversight

Major cloud service providers (AWS, Azure, Google Cloud) are likely to be designated as critical ICT third-party service providers, meaning:

  • Direct oversight by European Supervisory Authorities
  • Enhanced requirements for resilience and security
  • Regular audits and assessments
  • Mandatory incident reporting to ESAs

Benefits for Financial Institutions

Critical provider designation means:

  • Higher assurance of compliance
  • Standardized approaches across industry
  • Reduced individual due diligence burden
  • Greater regulatory certainty

Contractual Requirements

Essential Contract Clauses

DORA requires cloud contracts to include:

  • Service Descriptions: Clear definition of services, SLAs, and performance metrics
  • Data Location: Specification of where data will be stored and processed
  • Access Rights: Financial entity and regulator access to data and facilities
  • Audit Rights: Right to audit provider controls and security measures
  • Subcontracting: Notification and approval for material subcontractors
  • Incident Reporting: Provider obligations to report incidents
  • Exit Strategy: Procedures for service termination and data migration
  • Data Portability: Technical capabilities for data extraction

Negotiating with Cloud Providers

Practical approaches:

  • Use provider's DORA-compliant contract addendums where available
  • Join industry groups for collective negotiation power
  • Focus on material terms rather than minor modifications
  • Document any deviations with risk assessment and mitigations

Due Diligence and Risk Assessment

Pre-Contractual Assessment

Before engaging a cloud provider, assess:

  • Security certifications (ISO 27001, SOC 2, etc.)
  • Financial stability and business continuity
  • Data center locations and compliance with data residency
  • Incident history and response capabilities
  • Subcontracting arrangements
  • Insurance coverage

Ongoing Monitoring

Continuous oversight should include:

  • SLA compliance tracking
  • Incident monitoring and analysis
  • Review of provider audit reports
  • Changes to service or subcontractors
  • Emerging security threats

Concentration Risk Management

Understanding Concentration Risk

DORA requires managing risks from:

  • Over-reliance on single cloud provider
  • Critical functions dependent on one provider
  • Multiple financial institutions using same provider

Mitigation Strategies

  • Multi-Cloud Architecture: Distribute critical workloads across providers
  • Hybrid Cloud: Maintain on-premise alternatives for critical functions
  • Portable Architectures: Use containerization and standard APIs
  • Exit Planning: Regular testing of migration procedures

Data Protection and Sovereignty

Data Location Requirements

Ensure compliance with:

  • GDPR data residency requirements
  • National data protection laws
  • Regulatory expectations for data location

Data Security Controls

  • Encryption at rest and in transit
  • Key management (preferably customer-managed keys)
  • Access controls and authentication
  • Data loss prevention
  • Secure data deletion upon termination

Exit Strategies

Planning for Provider Change

Comprehensive exit strategy must cover:

  • Data Extraction: Procedures and tools for data retrieval
  • Service Continuity: Minimizing disruption during transition
  • Timeline: Reasonable notice periods and migration timeframes
  • Cost: Associated costs for data transfer and extraction
  • Testing: Regular validation of exit procedures

Testing Exit Capabilities

Regularly validate:

  • Data export functionality
  • Compatibility with alternative providers
  • Time required for complete migration
  • Completeness and integrity of extracted data

Cloud-Specific Security Considerations

Shared Responsibility Model

Understand division of security responsibilities:

Layer Provider Responsibility Customer Responsibility
Infrastructure ✓
Hypervisor ✓
Operating System Varies Varies
Application ✓
Data ✓
Access Management ✓

Cloud Security Controls

Implement comprehensive controls:

  • Identity and access management (IAM)
  • Network security groups and segmentation
  • Logging and monitoring
  • Configuration management
  • Vulnerability management
  • Backup and disaster recovery

Multi-Cloud Complexity

Challenges

  • Different security models and tools per provider
  • Complexity in monitoring and governance
  • Skills requirements for multiple platforms
  • Integration and data transfer between clouds

Management Approaches

  • Cloud management platforms for unified visibility
  • Standardized security policies across clouds
  • Centralized logging and monitoring
  • Infrastructure-as-code for consistency

Regulatory Access and Audit

Ensuring Regulatory Access

Contracts must guarantee:

  • Financial entity access to all data and systems
  • Competent authority access for inspections
  • Audit firm access for assessments
  • No unreasonable delays or restrictions

Supporting Supervisory Requests

Be prepared to:

  • Provide documentation of cloud arrangements
  • Facilitate regulator meetings with providers
  • Produce audit reports and certifications
  • Demonstrate compliance with contractual requirements

Cloud Migration and DORA

Pre-Migration Planning

  • Risk assessment of migration project
  • DORA compliance requirements in selection criteria
  • Contractual negotiations before commitment
  • Change management processes

Post-Migration Validation

  • Verify all DORA controls are operational
  • Test incident response procedures
  • Validate backup and recovery
  • Review and update documentation

Best Practices Summary

  • Start DORA compliance discussions with cloud providers early
  • Use standardized contract addendums where available
  • Implement robust cloud security controls
  • Regularly test exit and migration capabilities
  • Maintain comprehensive documentation
  • Monitor provider performance and incidents
  • Consider concentration risk in architecture decisions
  • Engage with industry peers on common challenges