Regulation (EU) 2022/2554, the Digital Operational Resilience Act (DORA), which entered into force on 17 January 2025, has brought the EU insurance sector squarely within a harmonised framework designed to prevent, detect, respond to and recover from ICT-related incidents. According to the original report, the Italian insurance supervisory authority IVASS has moved quickly to translate DORA’s obligations into operational instructions for insurance and reinsurance undertakings and larger intermediaries, signalling a new regulatory emphasis on cyber resilience across the sector. [1][2]
IVASS’s initial guidance includes two Letters to the Market that set out obligations for prompt reporting of “major” cyber incidents and, on a voluntary basis, the reporting of cyber threats. The company said in a statement-like communication that insurers must follow specific timelines and content requirements when notifying authorities, and IVASS has provided reporting templates intended to standardise notifications and accelerate supervisory response. Industry advisories note that these measures mark a step-change in supervisory oversight of ICT incidents in insurance. [1][2][7]
Beyond incident reporting, IVASS’s instructions require firms to maintain a register of ICT contracts and to strengthen internal ICT risk-management frameworks. The DORA regulatory technical and implementing standards define criteria for incident classification, minimum content for reports and expectations for ICT risk-management governance, which supervisors will use to assess compliance. Industry data shows these technical standards are detailed and prescriptive, covering governance, testing, continuity and recovery arrangements. [1][4]
National supervisors across the EU are aligning their own instruments with DORA. For example, Luxembourg’s CSSF has issued Circular CSSF 25/882 to clarify requirements for the use of third-party ICT services and the submission of related information, reinforcing DORA’s focus on risks arising from external providers. At the EU level, the European Banking Authority’s oversight role is being used as the model for supervising critical ICT third-party providers, with powers to investigate, recommend measures and, where necessary, impose sanctions. These layers of oversight mean insurers must now manage both firm-level resilience and the resilience of key suppliers. [5][6]
Legal advisories and law firms summarising IVASS’s Letters emphasise practical implications: firms should review incident-detection and escalation procedures, ensure reporting templates and timelines are embedded in internal processes, map ICT contracts to support the required register, and test recovery plans against DORA’s expectations. The company claims that compliance will demand closer coordination between legal, IT, outsourced-provider managers and senior management. Supervisors will expect documented evidence of governance, testing and contractual controls. [3][7]
The direction of travel is clear: DORA establishes far-reaching, harmonised obligations that will increase supervisory scrutiny of cyber incidents and third-party risk across the European insurance sector. Firms that treat the IVASS letters as merely administrative will risk falling short of the technical standards and oversight regime described in the DORA texts; conversely, those that use the guidance to harden detection, reporting and third-party oversight will be better placed to meet supervisory expectations and reduce operational disruption. Practical steps now include updating incident-response playbooks to DORA templates, populating and maintaining an ICT-contracts register, and documenting end-to-end testing and recovery outcomes for scrutiny by supervisors. [1][4][5][3]
##Reference Map:
- [1] (JD Supra) - Paragraph 1, Paragraph 2, Paragraph 5, Paragraph 6
- [2] (IVASS media avviso) - Paragraph 1, Paragraph 2
- [3] (DLA Piper / Derisk Newsletter) - Paragraph 5, Paragraph 6
- [4] (DORA RTS/ITS overview) - Paragraph 3, Paragraph 6
- [5] (CSSF circular) - Paragraph 4, Paragraph 6
- [6] (EBA overview) - Paragraph 4
- [7] (CMS Law analysis of IVASS Letter) - Paragraph 2, Paragraph 5
Source: Noah Wire Services