DORA compliance is improving, but the MFSA identifies important implementation gaps

Where Further Work Is Required

Despite the overall improvement, the MFSA identified recurring weaknesses among licence holders whose controls were not fully achieved.


 

ICT Risk Management and Governance

Some entities continue to experience difficulty maintaining a complete and current ICT risk register. The MFSA specifically highlights the need to identify all sources of ICT risk and continuously assess relevant cyber threats and ICT vulnerabilities.

It also identified weaknesses in crisis communication planning, communication arrangements for internal and external stakeholders, and the regular testing of mechanisms used to detect anomalous activities, network performance issues and ICT-related incidents.

The MFSA also points to change management, encryption and cryptographic controls, and access management as areas where implementation needs to become more consistent. Firms should therefore look beyond the headline themes and assess whether these foundational controls are demonstrably effective across the wider ICT risk management framework.


 

Incident and Cyber-Threat Classification

Although progress was recorded in incident management and regulatory reporting processes, the MFSA found that ICT incidents are not always classified using the criteria prescribed by DORA. Their impact may therefore not be assessed consistently or escalated appropriately.

Similar weaknesses were observed in the assessment of significant cyber threats, particularly when considering the criticality of the services that could be affected. Incomplete classification can undermine the quality and timeliness of incident response and regulatory reporting.


 

Digital Operational Resilience Testing

The MFSA noted that some licence holders have not established an approved Digital Operational Resilience Testing Programme. Others have not demonstrated that appropriate testing is performed at least annually across all ICT systems and applications supporting Critical or Important Functions.

This creates a risk that vulnerabilities, dependencies and failure scenarios remain unidentified, particularly under stressed or disrupted operating conditions.


 

ICT Third-Party Risk

Progress has been made in assessing ICT concentration risk. However, the report continues to highlight contractual alignment, third-party oversight and the practical implementation of the DORA Regulatory Technical Standards as areas requiring further attention.

For boards and senior management, the immediate question is whether these weaknesses could also exist within their own organisation. Can management evidence a complete ICT risk register, consistent incident classification, annual testing across all systems supporting Critical or Important Functions, and effective oversight of material ICT providers?


 

What BDO Is Seeing in Practice

In BDO Malta’s work supporting financial entities with DORA gap assessments, internal audits and MFSA thematic reviews, we have encountered several of the same implementation challenges highlighted by the MFSA.

The most persistent challenges often relate not to the absence of policies, but to the ability to demonstrate that requirements are complete, interconnected and operating in practice. Examples encountered during our work include:

• incomplete ICT and information-asset inventories, particularly where business services, systems and third-party dependencies have not been mapped;
• digital operational resilience strategies that lack measurable objectives, KPIs, KRIs or defined impact tolerances;
• incident processes that do not fully incorporate DORA classification criteria and reporting decision points;
• limited evidence of testing across all systems supporting Critical or Important Functions;
• incomplete or generic exit plans for material ICT providers;
• third-party inventories and Registers of Information that have not been formally reconciled, validated and maintained; and
• insufficient evidence that remediation actions have been implemented and embedded, rather than merely documented.

Taken together, these recurring issues point to a common challenge: firms may have policies and risk documentation in place while still lacking the dependency mapping, tailored exit planning, formal incident classification and operating evidence needed to demonstrate effective implementation.


 

How BDO Malta Can Help

BDO Malta’s Technology Advisory & Assurance team can support regulated entities through:

• DORA readiness and gap assessments aligned with the latest MFSA supervisory framework;
• independent internal audits and remediation validation, including testing whether actions are operating effectively;
• ICT risk framework enhancement, covering governance, strategies, inventories, risk registers and management reporting;
• incident management readiness, including classification methodology, escalation, reporting workflows and simulation exercises;
• digital operational resilience testing programmes, linked to Critical or Important Functions and their supporting ICT assets;
• ICT third-party risk reviews, including due diligence, contractual requirements, concentration risk, subcontracting and exit planning;
• Register of Information quality reviews and reconciliation; and
• Board and role-based DORA training tailored to governance and operational responsibilities.

BDO Malta has assisted several organisations with MFSA thematic reviews, DORA assessments, internal audits and ongoing remediation. Its work covers ICT risk management, third-party risk, business continuity, incident reporting, information security and resilience testing. 

The Key Message for Boards

The MFSA’s findings are positive, but they should not lead to complacency. With 26% of assessed controls still rated as partially achieved or not achieved, boards should seek clear evidence that DORA controls are not only documented, but consistently implemented, tested and monitored.

If your organisation is preparing for an MFSA engagement, validating remediation or testing whether its DORA framework operates effectively, BDO Malta can help identify priority gaps and define a proportionate path to stronger operational resilience.