Compliance in everyday life - making DORA and digital security easier to navigate

Compliance is no longer something that belongs only in legal documents, audits and annual reviews. For many companies, it has become a fixed part of everyday life. This applies in the dialogue with customers, in supplier management, in security work and in the requirements placed on documentation.

We notice this clearly at Nobly.

Today, more customers are asking for concrete documentation of how we work with information security, risk management, access control, contingency, supplier management and operational stability. This is particularly true for customers in regulated industries, where the requirements for digital resilience and documentable controls have been tightened.

DORA as an example of a broader development

DORA - the Digital Operational Resilience Act - is the EU’s regulation on digital operational resilience in the financial sector. It requires financial companies to be able to withstand, respond to and recover from IT outages, cyberattacks and other digital disruptions.

But DORA is not only about internal systems. It is also about the suppliers that financial companies depend on.

This means that customers in the financial sector increasingly need to be able to document how their critical suppliers work with security, operations, risk and compliance. For us, that means we not only have to keep our own processes in order - we also have to be able to show it in a way that makes it easier for our customers to document their own compliance.

And DORA is not an isolated case. It is a clear example of a broader development, where compliance moves into everyday life - and out into the supply chain.

Our approach is broader than a single framework

At Nobly, we work in a structured way with compliance across frameworks, customer requirements and legislation. DORA is an important part of the picture, but not the whole picture.

Among other things, we work with:

• Information security and access management
• Risk assessments and controls
• Contingency and incident management
• Supplier management and third-party risks
• Documentation of processes and responsibility
• Independent auditing and control trails

The goal is simple: we need to be able to document how we work with security and compliance - and make it easier for our customers to use that documentation in their own processes.

That is the value we want to pass on to our customers: confidence, transparency and a stronger foundation for their own compliance.