By 2026, the digital landscape of Ukraine has fully integrated into the European legal and technological framework. For CIOs and CTOs in the financial sector and related industries operating with the EU, DORA (Digital Operational Resilience Act) has evolved from a regulatory requirement into a foundation for survival. Under martial law, where energy infrastructure and cybersecurity are critical, DORA compliance is not just about meeting standards—it is about the business's ability to function amidst constant threats.
DORA mandates a paradigm shift: moving from simple perimeter defense to ensuring business continuity under any circumstances. This requires a deep transformation of IT infrastructure, a review of redundancy strategies, and the adoption of new risk management approaches where every AI agent or cloud service must be verified and secured.
The Essence and Principles of Digital Operational Resilience
The key difference between DORA and classic security standards like ISO 27001 is the focus on operational resilience. While ISO emphasizes data confidentiality and integrity, DORA asks: "How quickly can you restore service if your provider disappears or your data center loses power?" The directive's pillars include ICT risk management, incident reporting, penetration testing, and third-party risk management.
In 2026, DORA requires IT leaders to go beyond having a Disaster Recovery Plan (DRP); it demands proof of its effectiveness through regular stress tests, including scenarios of total blackouts or massive cyberattacks. CIOs must transition to an architecture where critical business functions have zero dependency on single points of failure, even within cloud services.
Resilience Architecture: From Redundancy to Autonomy
Modern architecture compliant with DORA is based on Zero Trust and Resilience by Design principles. This means every network element, every QES (Qualified Electronic Signature) service, and every AI agent processing financial transactions must be isolated and controlled.
To ensure resilience, the architecture must include:
- Hybrid Infrastructure: A combination of on-premises capacity for critical data and cloud resources for scalability.
- Energy Independence: Integration of guaranteed power supply systems at the server node level.
- Multi-Factor Authentication: Mandatory use of QES and Diia.Signature (a government-backed mobile digital signature service) for all access levels to critical systems.
- AI Monitoring: Using generative models for predictive anomaly detection in network traffic.
Criteria for Selecting Technological Solutions
Selecting solutions for DORA compliance requires evaluating not only functionality but also the vendor's ability to maintain stability in the long term.
| Criterion | Local Solutions | Cloud Solutions | Hybrid Solutions |
|---|---|---|---|
| Data Control | Full | Limited | High |
| Scalability | Low | High | High |
| DORA Compliance | Requires configuration | Depends on provider | Best choice |
| Blackout Resilience | Depends on power | High | Maximum |
Implementation Practice: A Step-by-Step Algorithm
Implementing DORA is a multi-month project requiring cooperation between IT and legal departments. TechCom, a Kyiv-based systems integrator in business since 2003, has extensive experience in executing such complex projects, helping financial institutions and industrial enterprises build resilient IT landscapes.
- Asset and Risk Audit: Inventory of all ICT systems and assessment of their criticality to the business.
- Incident Classification: Development of internal regulations in accordance with NIS2 and DORA requirements.
- Infrastructure Modernization: Implementation of redundancy systems and ensuring energy independence.
- Testing: Conducting TLPT (Threat-Led Penetration Testing) to verify resilience.
- Staff Training: Increasing awareness regarding cyber threats and working with QES.
Common Mistakes and Risks
The biggest mistake is viewing DORA as merely "paperwork." Many companies attempt to meet requirements solely by drafting policies, ignoring technical implementation. Another risk is over-reliance on a single cloud provider, which directly contradicts DORA's risk diversification principles. Furthermore, ignoring the security of AI agents is critical, as they are becoming a new attack vector with access to large datasets and susceptibility to input manipulation.
The Economics of Resilience: Assessing the Effect
Assessing the efficiency of investments in DORA compliance should be based on Business Continuity metrics. Instead of hypothetical ROI, CIOs should focus on:
- RTO (Recovery Time Objective): Reducing recovery time after an incident.
- RPO (Recovery Point Objective): Minimizing data loss.
- Cost of Downtime: Calculating losses from critical process interruptions per hour.
- Lower Insurance Premiums: Certified resilience often allows for optimized cyber insurance costs.
Investing in DORA is an insurance policy for the business, allowing not only to avoid fines but to ensure continuity when competitors might be forced to halt operations.
Conclusion
DORA is not about restrictions, but about new standards of quality and reliability. For Ukrainian companies aiming to operate in EU markets, this is a mandatory stage of evolution. Resilience today is a combination of reliable hardware, secure cloud services, and a sound risk management strategy. By starting implementation now, you are not just fulfilling regulatory requirements, but creating a foundation for the stable development of your business in the future.