Meet DORA email requirements with Zivver

DORA introduces rules pertaining to the protection, detection, containment, recovery, and repair capabilities against ICT related incidents. It outlines regulations concerning ICT risk management, incident reporting, operational resilience testing, and ICT third-party risk monitoring.

The regulation defines financial entities in a broad and self-inclusive way. The financial institutions mentioned include, but are not limited to credit institutions, payment institutions, investment firms and more.

Due to a lack of security functionality, email is inherently insecure and poses some great challenges in meeting regulations such as DORA. For example, standard email traffic is not encrypted, making it susceptible to interception and unauthorized access. As a result, email does not guarantee the confidentiality of sensitive data. 

In addition, 2FA is a common security measure in many services, it is rarely implemented in email communication, leading to potential unauthorized access and data breaches, and falling short of DORA's stringent security mandates.

We don’t hold client decryption keys, ensuring the total data confidentiality. To prevent unathorized access once an email has been received, users can apply 2FA controls or expiration controls.

Zivver also enables users to recall emails, without limits. So, if a mistake happens, employees can view the status of an email (including whether it has been accessed, forwarded, and by who), and guarantee an incident has been avoided in the instance it is yet to be opened.