DORA Information Sharing: Collective Cyber Defence

Article 45 enables and encourages voluntary sharing of cyber threat information among financial entities, such as attack indicators, tactics, and vulnerabilities. The goal is a collective improvement of defensive capability across the financial sector, since individual companies often only see a partial picture of the actual threat landscape.

Participation itself is voluntary; DORA doesn't mandate a specific arrangement or platform. In practice, though, active participation is increasingly viewed as a sign of proactive ICT risk management, since it shows a company contributing to sector-wide resilience beyond the bare minimum of compliance.

Shared information mainly covers technical indicators such as suspicious IP addresses or attack patterns, descriptions of new attack tactics, and warnings about actively exploited vulnerabilities. Sensitive internal details, such as the specific impact of an entity's own incident, are usually shared in anonymized or aggregated form.

Common channels include sector-specific information-sharing communities and CERT structures that provide structured formats for exchange, as well as bilateral arrangements between individual companies. The specific choice often depends on which communities are already established in the relevant national financial sector.

Before participating, it's worth clarifying which information can be shared without antitrust concerns; pure threat indicators are generally unproblematic, while company-specific detail should be handled more carefully. Contractual confidentiality agreements within the relevant sharing community typically govern how shared information may be reused.