Hot topic

Cybersecurity & Information Protection

Learn more about the challenges of cybersecurity and how we can assist you

Quick access

How we can help
Cyber attacks
DORA
News
Contacts

Cyber related crime is on the rise, both in quantity and sophistication. Most systems today are connected making them vulnerable. Further, personal and business data is viewed as the “new gold” and may be very valuable.

The challenging landscape of cybersecurity threats is continuously evolving, and every organisation should adopt a suitable strategy for protection, detection and response to cyberattacks.

Any such strategy must address several questions: How ready is my organization to face a cyber attack or data breach? Do we have a crisis team/incident response plan in place? Do we know what regulations are in place that are related to cyber/data breaches and the necessary reporting requirements? And the list goes on.

To answer these questions, Arendt has developed a One-Stop-Shop offering that provides comprehensive support from a legal, regulatory and operational perspective, delivered by a multidisciplinary team.

How can we help?

The danger is out there, and it is forecast to become worse – let’s not wait for something to happen. Adopting a proactive approach is always better. Arendt is committed to support you as an advisor and facilitator, no matter where you may be in your cybersecurity & information protection journey.

Crisis Management – We have a dedicated Cybersecurity & Information Protection team that is there to help you when an incident happens.
Response readiness – We are also here to help you before a cyber attack or data breach occur, through a variety of services:
- we offer a quick health check / stress test of your existing practices
- our team can assess your risks across your organisation and build a cybersecurity & information protection roadmap to help you respond most effectively during times of crisis
- we can support you with a continued review of your readiness and provide your board of directors and management with (regulatory) awareness and response training
- we can implement a hotline providing peace of mind in case you sense an issue, have questions or need immediate help.

Learn more about

our Cybersecurity & Information Team expertise

and how they can help you here

About DORA

DORA (Digital Operational Resilience Act)

As financial services become increasingly dependent on technology and ICT third-party providers, digital resilience has become a key supervisory priority across Europe. The Digital Operational Resilience Act (DORA), applicable since 17 January 2025, establishes a harmonised EU-wide framework that is aimed at ensuring financial entities can withstand, respond to, recover from, and learn from ICT-related disruptions and cyber threats.

DORA applies directly to a broad range of financial entities, including credit institutions, investment firms, payment institutions, insurance undertakings, fund managers, and cryptoasset service providers, as well as indirectly to their ICT third-party service providers. In Luxembourg, DORA is complemented by the Law of 1 July 2024, with the CSSF and the CAA acting as the competent authorities responsible for supervision and enforcement.

DORA is built around five core pillars:

ICT risk management
ICT-related incident management, classification and reporting
digital operational resilience testing
managing ICT third-party risk
information-sharing arrangements

Beyond these five pillars, DORA places significant emphasis on management body accountability, requiring boards and senior management to actively oversee and remain responsible for their organisation’s digital operational resilience framework.

Since DORA became applicable, the European Supervisory Authorities (EBA, ESMA and EIOPA) have progressively finalised the majority of the associated Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS), providing further detail on topics such as ICT risk management, incident reporting, resilience testing, subcontracting arrangements and third-party risk management. Organisations are therefore expected not only to achieve initial compliance but also to demonstrate that digital operational resilience is embedded as an ongoing operational capability rather than a one-off regulatory exercise.

Therefore, DORA is no longer a future compliance project; it is now a supervisory reality requiring financial entities to demonstrate operational resilience, effective governance, and continuous oversight of their technology ecosystem.

Learn more about DORA