When the Digital Operational Resilience Act (DORA) grew to become enforceable throughout the European Union in January 2025, it triggered an administrative dash. Monetary entities spent the primary yr establishing danger governance, assessing third-party service suppliers, updating contract clauses, and documenting incident escalation workflows.
Now in its second yr, the tougher a part of DORA is demonstrating how properly frameworks work in observe. EU regulators are growing their give attention to DORA implementation, Info and Communication Know-how (ICT) incident evaluation, and the effectiveness of ICT danger supervision. For safety groups, that raises an vital query: does the SOC have sufficient visibility to detect, examine, and scope an energetic intrusion throughout vital programs?
Whereas DORA doesn’t prescribe a selected safety stack, a number of of its necessities depend on steady visibility within the ICT setting to establish habits which will point out an rising danger.
Steady monitoring requires greater than a listing
For DORA, steady monitoring due to this fact isn’t nearly figuring out what needs to be taking place in a community; it’s about having sufficient visibility to acknowledge when operational patterns start to diverge from the norm.
Article 9, the ninth numbered provision of DORA, requires monetary entities to repeatedly monitor and handle the safety and functioning of their ICT ecosystem, and implement processes to attenuate the affect of ICT danger.
An asset stock exhibits the programs a monetary establishment owns or operates. Configuration information will present how these programs are supposed to work together. Safety logs and endpoint telemetry present detailed visibility into exercise on monitored programs.
But, none of these sources essentially offers a complete view of communication between programs, notably throughout legacy infrastructure, specialised home equipment, unmanaged units, or programs the place endpoint telemetry is restricted. When confronting adaptive, AI-speed threats, a complete view is critical to establish the blind spots adversaries particularly goal. Unmonitored connections between programs could maintain proof of exploitation, and corporations which have visibility into what’s taking place in these gaps have a higher chance of disrupting the assault chain.
For example, if a payment routing application that normally communicates with an external credit assessment service suddenly communicates substantially more with unfamiliar internal hosts during non-work hours, network telemetry can expose the anomaly even when the application’s own logs don’t.
Detecting anomalies requires context
Article 10, the next rule in DORA, requires financial institutions to swiftly detect anomalous activities, including network performance issues and related incidents. Further, thresholds must be established for when incident response needs to be triggered.
Security alerts are plentiful, but the volume of noise often overwhelms teams and hides the true signals of anomalous behavior. Determining if an alert is part of a larger incident is the real issue. For instance, EDR may identify a suspicious process while an identity system flags a suspicious login. Network data can connect the two by showing which systems communicated, the protocols used, and what happened next. Command-and-control traffic, reconnaissance, lateral movement, and data transfers all leave traces in network traffic, even when other telemetry is incomplete or unavailable.
NDR makes network evidence usable at scale by extracting structured, protocol-level data that helps analysts investigate alerts in context and in a correlated view rather than reconstructing incidents from siloed sources. Context allows responders to establish an incident’s scope and impact, especially in light of today’s AI-speed attacks, both of which inform Article 19 reporting requirements.
Under applicable rules, the initial notification must be submitted as early as possible, but no later than four hours after classification as a major ICT-related incident and no later than 24 hours after the organization becomes aware of the incident. Rapid access to network evidence gives responders the clarity needed to move quickly across complex IT environments, tracing affected systems, isolating rogue connections, and assembling the required incident records within the regulation’s required timeframe.
Third-party risk extends beyond the contract
Third-party ICT risk management and contractual agreements are the focus of Articles 28 through 30.
Contracts and vendor assessments define a provider’s authorized access and operational boundaries on paper. Network data shows how that provider’s software packages, tunnels, and API integrations actually function inside the IT environment, which details whether connections adhere to approved data paths or actively deviate from expectations.
If, for instance, a trusted vendor’s credentials are compromised, the credentials’ access remains legitimate but behavior likely changes. Network evidence from NDR allows the financial organization to observe that activity from its own environment and ask questions that vendor documentation can’t answer:
- Which internal systems is the connection communicating with?
- Does the traffic match the documented scope?
- Has connection timing, protocol use, or data volume changed?
Year two: test whether the controls work
As financial institutions move into year two of DORA, it’s clear that network visibility is directly relevant to the requirements in Articles 9 and 10: continuous monitoring, detection, and rapid response. Network data also helps organizations thoroughly investigate incidents involving ICT third-party providers, as mandated in Articles 28 through 30.
NDR can provide that visibility by showing how systems communicate, where anomalous activity occurs, and how incidents move through an environment. Where DORA requires financial entities to detect, investigate, and respond to ICT-related incidents, the more useful question may be simple: does your SOC have the evidence to respond to and contain an attack?
Corelight Network Defense
Corelight network detection and response (NDR) delivers data that’s open, transparent, and explainable—helping detect evasive threats, reduce triage time, and enable agentic AI throughout the SOC. Corelight’s structured network evidence preserves protocol-level context to produce a more complete dataset for investigation and AI. When analysts and AI can reason from evidence instead of isolated alerts or metadata, they can validate findings, reconstruct activity, and reach more reliable conclusions. Learn more about Corelight.
