DORA is in place. Is that the full picture?

So it's natural to assume that cybersecurity regulation is largely covered.

There is, however, another piece of EU legislation that approaches cybersecurity from a different angle: the Cyber Resilience Act (CRA).

The difference is simple. DORA looks at the firm, meaning how it manages ICT risk, incidents and third parties. The CRA looks at products, meaning the software and connected devices placed on the EU market and how securely they are designed and maintained.

For most financial services firms, that may sound like someone else's concern. But many firms today provide clients with more than a service. They offer mobile apps, installable trading or banking software, authentication devices, or other digital tools that clients use on their own devices.

Where that's the case, part of the firm's offering may fall within the CRA, separately from its DORA obligations.

This doesn't necessarily mean a significant new burden. Much of what DORA has already put in place, such as vulnerability management, incident handling and third-party oversight, provides a strong foundation. The question is whether it covers what the CRA expects.

If your firm provides clients with an app or other software, it may be worth asking how the CRA fits alongside your existing framework. We'd be happy to talk it through.