The financial services industry has become one of the most targeted sectors for cyberattacks. From ransomware and data breaches to supply chain attacks and third-party risks, financial organisations face an increasingly sophisticated threat landscape. At the same time, regulators are raising the bar for cybersecurity, requiring institutions to demonstrate not only strong security controls but also the ability to withstand, respond to, and recover from operational disruptions.
To address these growing challenges, the European Union introduced the Digital Operational Resilience Act (DORA). Effective as of January 17, 2025, DORA establishes a comprehensive framework for managing Information and Communication Technology (ICT) risk across the financial sector. Rather than focusing solely on preventing cyber incidents, DORA emphasizes building operational resilience and the ability to continue delivering critical services before, during, and after an ICT disruption.
While DORA is not a product certification or technology standard, it requires organizations to implement appropriate technical and organisational measures to protect critical systems and sensitive information. For many financial institutions, removable media, portable storage, and endpoint peripherals remain overlooked sources of cyber risk.
This is where DataLocker helps.
Through enterprise-grade encrypted storage, centralised device management, and certified data erasure, DataLocker enables financial organisations to implement many of the technical controls that support DORA’s operational resilience requirements.
What is DORA?
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) is the European Union’s regulation on digital operational resilience for the financial sector.
Unlike broader cybersecurity regulations, DORA establishes a single framework for managing ICT risk across banks, insurance companies, investment firms, payment providers, crypto-asset service providers, and other financial entities.
Its objective is straightforward:
Ensure financial institutions can prevent, withstand, respond to, and recover from ICT-related disruptions and cyberattacks without compromising critical financial services.
DORA is built around five primary pillars:
- ICT Risk Management
- ICT Incident Management and Reporting
- Digital Operational Resilience Testing
- ICT Third-Party Risk Management
- Information Sharing
Rather than prescribing specific technologies, DORA requires organisations to implement appropriate security controls based on risk, criticality, and business operations.
Who Does DORA Apply To?
DORA applies to a broad range of financial entities operating within the European Union, creating a consistent digital operational resilience framework across the financial ecosystem. Covered organisations include banks, credit institutions, payment institutions, electronic money institutions, investment firms, insurance and reinsurance companies, trading venues, central securities depositories, credit rating agencies, crypto-asset service providers, crowdfunding platforms, and many other regulated financial organisations. Importantly, financial entities must manage the ICT risks created by third-party service providers, while only providers formally designated as critical ICT third-party service providers are subject to DORA’s dedicated EU oversight framework. By establishing common resilience requirements across the sector, DORA helps ensure that organisations throughout the financial supply chain maintain strong cybersecurity and operational resilience practices.
Why Removable Media Still Matters in Financial Services
Financial institutions invest heavily in:
- Identity and access management
- Endpoint Detection and Response (EDR)
- Security Information and Event Management (SIEM)
- Zero Trust architectures
- Data Loss Prevention (DLP)
Yet removable media continues to present significant risk.
USB storage devices remain common for:
- Secure file transfers
- Regulatory reporting
- Disaster recovery
- Air-gapped systems
- ATM and branch infrastructure
- Trading systems
- Vendor support
- Backup operations
Without proper controls, removable media can introduce malware, facilitate unauthorised data transfers, or expose sensitive customer information.
Operational resilience requires these risks to be managed, not ignored.
How DataLocker Supports Selected DORA Technical Controls
It is important to highlight that DataLocker does not certify DORA compliance.
Instead, DataLocker provides enterprise security controls that assist financial organisations address selected technical controls relevant to DORA’s ICT risk management requirements.
1. ICT Risk Management
DORA Requirement
Organisations must establish comprehensive ICT risk management frameworks that identify, assess, protect against, detect, respond to, and recover from ICT risks.
How DataLocker Helps
DataLocker reduces one of the most common endpoint risks:
- Unmanaged USB devices
- Consumer flash drives
- Unauthorised removable media
- Shadow IT storage
SafeConsole enables organisations to:
- Standardize approved encrypted storage
- Enforce centralised security policies
- Require hardware encryption
- Restrict unauthorised USB storage with PortBlocker
- Continuously monitor compliance
These capabilities help reduce the attack surface associated with removable media.
2. Data Protection and Encryption
Financial organisations routinely handle:
- Customer financial records
- Personally identifiable information (PII)
- Payment data
- Trading information
- Intellectual property
- Regulatory documents
Protecting this information is central to DORA.
- AES 256-bit hardware encryption
- Secure cryptographic processors
- Automatic encryption
- Hardware key protection
- Tamper-resistant architecture
- Brute-force protection
Even if a device is lost or stolen, encrypted data remains protected.
3. Device-Level Incident Containment and Response
DORA emphasises organisations’ ability to quickly respond to ICT incidents.
SafeConsole supports incident response through:
- Remote device disable
- Remote lock
- Password reset
- Encryption key destruction
- Device recovery
- Compliance monitoring
Administrators can quickly reduce risk associated with lost or compromised devices while maintaining visibility throughout the incident. These capabilities support device-level containment and do not replace an organization’s broader DORA incident-management and service-recovery processes.
4. Removable Media Asset Visibility
Organisations cannot secure assets they cannot see.
SafeConsole provides centralised visibility into:
- Device inventory
- Firmware versions
- Assigned users
- Compliance status
- Capacity
- Serial numbers
- Device location
- Audit history
This supports ICT asset governance within the managed removable-media environment while contributing to broader operational resilience objectives.
5. Audit Evidence and Compliance Documentation
DORA requires organisations to demonstrate effective governance and maintain evidence supporting their ICT controls.
SafeConsole records:
- Administrative activity
- Device usage
- Authentication events
- Policy changes
- Compliance status
- Remote administrative actions
Detailed reporting can support internal audits, control reviews, incident investigations, and compliance documentation. It does not replace DORA’s formal process for classifying and reporting major ICT-related incidents.
6. Supporting Secure Technology Procurement
One of DORA’s defining characteristics is its focus on ICT third-party providers.
DORA’s ICT third-party risk requirements are broader than product selection and include governance, due diligence, contractual arrangements, concentration risk, audit and access rights, continuity, and exit planning.
DataLocker can support secure procurement decisions for removable media through:
Enterprise-grade hardware: Purpose-built encrypted storage designed for enterprise environments.
Trusted supply chain: Manufacturing and sourcing practices that can be considered as part of supplier due diligence.
Industry certifications: FIPS validation on applicable products
These characteristics can support secure technology-selection decisions while remaining only one part of the financial entity’s broader third-party-risk process.
7. Complementary Zero Trust Controls for Removable Media
Financial institutions increasingly adopt Zero Trust architectures. Zero Trust is not a standalone DORA requirement, but its principles can complement DORA-related ICT risk management.
DataLocker’s SafeConsole extends Zero Trust principles to removable media by enabling organisations to:
- Block unauthorised USB storage with PortBlocker
- Allow only approved encrypted devices
- Restrict peripheral access
- Create trusted allow lists
- Reduce unauthorised data movement
This minimizes opportunities for malware introduction and unauthorized data exfiltration.
8. Secure Device Lifecycle Management
Secure device lifecycle practices can support broader ICT risk-management, asset-governance, and information-protection objectives.
Although DORA does not prescribe a specific data erasure technology, organisations should manage residual information risk when devices are reused, returned, or retired.
DataLocker’s Certified Data Erasure solution provides:
- Cryptographic erasure
- Verifiable destruction reports
- Immutable audit evidence
- Blockchain-backed certificate validation through SafeLedger
These capabilities help demonstrate secure disposal practices while supporting governance and audit requirements.
Mapping DataLocker Capabilities to Selected DORA Areas
| DORA Objective | DataLocker Capability |
| ICT risk management | SafeConsole centralised management and policy enforcement |
| Removable-media asset visibility | Managed removable-media inventory and lifecycle visibility |
| Data protection | AES-256 hardware encryption |
| Device-level incident response | Remote lock, disable, credential reset, audit logs |
| Secure procurement support | Enterprise-grade hardware and FIPS validation on applicable products |
| Operational resilience | Managed encrypted storage and centralized administration as part of a wider resilience program |
| Governance and control evidence | Audit trails and compliance documentation for managed devices |
| Access control | Hardware authentication, smart cards, Windows Hello, Touch ID |
| Complementary Zero Trust controls | SafeConsole USB peripheral control with PortBlocker |
| Secure disposal | Certified Data Erasure and SafeLedger verification |
Beyond Compliance: Building Operational Resilience
DORA represents a significant shift in digital operational resilience strategy for financial institutions. Rather than measuring compliance through individual security technologies, the regulation emphasises an organisation’s ability to maintain critical business operations despite cyber incidents, technology failures, or third-party disruptions.
Operational resilience requires layered security controls that reduce risk while providing visibility, governance, and rapid response capabilities. DataLocker supports these objectives by helping organisations secure removable media, which is one of the most frequently overlooked attack vectors. Through enterprise-grade encrypted storage, centralised management with SafeConsole, USB port control, secure peripherals, comprehensive audit logging, and certified data erasure, organisations can strengthen their ICT security posture while reducing operational risk.
When combined with identity management, endpoint protection, network security, and broader governance programs, DataLocker becomes an important component of a defense-in-depth strategy aligned with DORA’s operational resilience goals.
As cyber threats continue to evolve, financial institutions must move beyond traditional cybersecurity approaches and focus on resilience. DORA establishes a comprehensive framework for protecting critical financial services by requiring organisations to proactively manage ICT risk, strengthen governance, improve incident response, and reduce third-party risk.
While no single solution can deliver DORA compliance, DataLocker helps organisations implement selected practical technical controls relevant to the regulation. By securing removable media, enforcing centralised security policies, standardizing trusted hardware, and providing centralised visibility into managed device activity, DataLocker enables financial institutions to reduce risk, strengthen operational resilience, and better prepare for the increasingly demanding cybersecurity expectations facing today’s financial sector.