What is cyber threat information sharing?
Cyber threat information sharing is the exchange of attack knowledge among financial entities on the basis of Article 45 of Regulation (EU) 2022/2554, the Digital Operational Resilience Act (DORA). How it fits with the other obligations is set out in the DORA guide.
Indicators of compromise are technical traces such as hash values, IP addresses or domain names by which an attack can be recognised again.
Article 45 permits sharing; the only duty is notification
Article 45(1) is drafted as a permission: financial entities “may” exchange cyber threat information and intelligence among themselves. Recital 33 gives the reason. Doubts about which information can be shared with other market participants lead to useful information being withheld.
Recital 34 draws the conclusion that voluntary information-sharing arrangements have to be made possible at Union level. Article 45 sets the frame for them.
Article 45(3) requires financial entities to notify the competent authorities of their participation in an information-sharing arrangement. The notification falls due twice: upon validation of the membership, and once its cessation takes effect. Plan both notifications when you join.
Under which three conditions is sharing permitted?
Article 45(1) ties sharing to three conditions, all of which have to be met. The right-hand column turns each condition into a question to settle before joining.
| Point | Condition | Question before joining |
|---|---|---|
| (a) | The sharing aims to enhance digital operational resilience, for example through awareness, detection, mitigation, response and recovery. | Does every category of shared information visibly serve defence? |
| (b) | It takes place within trusted communities of financial entities. | Who decides on admission, and on which criteria? |
| (c) | It runs through arrangements with rules of conduct that fully respect business confidentiality, data protection under Regulation (EU) 2016/679 and guidelines on competition policy. | Does the arrangement address all three areas of law explicitly? |
Informal formats fail on point (c). A chat between colleagues does not meet it, because it lacks both the arrangement and the rules of conduct.
What must an information-sharing arrangement under Article 45 cover?
Article 45(2) requires every arrangement to define the conditions for participation. Where appropriate, details on three further points are added:
- the involvement of public authorities and the capacity in which they are associated,
- the involvement of ICT third-party service providers,
- operational elements, including the use of dedicated IT platforms.
Point (c) also requires the potentially sensitive nature of the shared information to be protected. Putting that protection into effect takes rules that paragraph 2 does not list:
- a classification scheme that sets who may pass a piece of information on,
- rules on anonymising or aggregating case references,
- retention and deletion periods,
- an owner for the quality of shared indicators,
- a procedure for excluding participants.
Article 45 does not replace reporting under Article 19
DORA sets out several routes for information about threats and incidents; the table compares the three that reach authorities or other financial entities.
| Route | Legal basis | Recipient | Status |
|---|---|---|---|
| Reporting of major ICT-related incidents | Art. 19(1) | competent authority | mandatory |
| Notification of significant cyber threats | Art. 19(2) | competent authority | voluntary, where the entity considers the threat relevant to the financial system, service users or clients |
| Information sharing | Art. 45 | other financial entities | voluntary; notifying participation is mandatory |
For the organisation this means that sharing under Article 45 runs alongside incident reporting and does not replace it. Which incidents count as major is covered in the entry on ICT incident classification.
Article 13 requires shared information to be evaluated
Article 13(1) requires capabilities and staff to gather information on vulnerabilities and cyber threats. The same paragraph requires an analysis of their likely impact on the entity's own resilience. Under paragraph 3, relevant information exchanged with counterparts is incorporated into the ICT risk assessment process on a continuous basis.
A sharing community supplies raw material that only becomes usable through the entity's own cyber threat intelligence. Shared indicators have to reach detection systems, shared tactics the scenarios for tests and exercises, and shared alerts the process for ICT-related incidents.
Checking threat reports against the asset register in Rizzqo
In Rizzqo a shared threat report can be turned into a risk assessment or a task on the affected object in the asset register. That is how the report enters the ICT risk assessment process, as Article 13(3) DORA requires. DORA is held in Rizzqo as a requirement catalogue, and its requirements appear on the objects they apply to.
When a report about an exploited vulnerability arrives, the team checks the register for the systems that may be affected. There it finds each system's owner and the primary assets it supports.
The risk assessment computes likelihood in per cent and impact in euros through a configurable matrix. The planned risk reduction of a task counts only once the task is completed. Tasks can be synchronised with Jira in both directions.