Adopting the provisions of the EU’s Digital Operational Resilience Act (DORA) is not inspiring a whole lot of additional confidence in supply chain cybersecurity among senior cybersecurity professionals, research by consultancy Green Raven Limited indicates.

UK financial entities engaging in cross-border operations with the EU must comply with DORA as of January 17th 2025.

Green Raven’s research, conducted for it by Censuswide, comprised a quantitative survey of 200 CISOs and senior cybersecurity professionals – specifically, those with responsibility for cybersecurity, cybersecurity teams and associated budgets in organisations of over 1,000 employees. This means that more than 10% of all UK organisations that employ at least 1,000 people were surveyed.

Of the 200 respondents, 21 were from financial entities. The results showed that overall, 44% of respondents agreed with the statement “Our supply chain feels like the weakest element of our cybersecurity regime.” Among financial sector respondents, 43% agreed with the statement.

Third-Party Risk Management (TPRM) is an issue on which banks, in particular, expend huge effort; the framework mandated by DORA also specifically addresses information and communication technology (ICT) suppliers.

Green Raven’s research also notes that an even higher proportion of senior cyber professionals (59 of 111 surveyed, i.e. 53%) from such organisations say their supply chain is the weakest link of their cybersecurity regime.

It’s important to note that this doesn’t imply low confidence levels – but it may be of concern to DORA-impacted financial institutions that supply chains remain the most prominent cyber risk identified by what are likely to be third-party suppliers to the financial sector.

Interpreting the research, Morten Mjels, CEO of Green Raven Limited, commented: “Our survey only addressed the biggest organisations in the UK, so it’s probable that all 21 of the financial organisations surveyed interact with the EU.

“So the standout observation for me is not the 43% proportion itself. It’s that – after all the preparations for DORA that they must have done – so many of them still feel their supply chains are their weakest link, and that the proportion is comparable to the full-sample proportion,” he explained.

Recommended reading

• Grappling with Cyber Vulnerabilities Despite Legislative Efforts
• IT and Security Leaders Admit Hardware Cybersecurity Gap
• Comment | Get Ready For New Cybersecurity Legislation on Connected Devices

“The responses of the other 57% of financial sector respondents might also beg a couple of questions. For example: if supply chain isn’t the weakest link in your cybersecurity regime then, given the low regard in which supply chain security is generally held, which link is it that’s worse than that? Or does it mean that they really got hold of their supply chain as they prepared for DORA and have real confidence in it,” he added.

“DORA will force not just financial organisations but organisations in general to look more closely at identifying, understanding and addressing supply chain cybersecurity risk. This process is something for which we’ve been developing specific tools and solutions that make it possible, practical and sustainable,” said Green Raven’s Mjels.