Cybersecurity teams already exchange indicators, detection rules, vulnerability information, and attacker techniques. For financial entities operating in the European Union, DORA Article 45 provides a regulatory framework for voluntary cyber threat intelligence sharing.
The challenge is not simply sending an indicator to another organisation. Teams need to ensure that the information is relevant, safe to disclose, shared through an appropriate arrangement, and usable by the receiving security team.
What Does Article 45 Cover?
Article 45 of Regulation (EU) 2022/2554 allows financial entities to exchange cyber threat information and intelligence to strengthen digital operational resilience. DORA has applied since 17 January 2025.
Examples of useful information include:
- Indicators of compromise, including malicious IP addresses, domains, and file hashes.
- Tactics, techniques, and procedures used by threat actors.
- Alerts about active campaigns and emerging threats.
- Defensive configuration information that helps reduce exposure.
Participation is voluntary, but participating entities must follow the conditions in Article 45. Sharing must support digital operational resilience, take place within trusted communities of financial entities, and follow arrangements with appropriate rules of conduct.
Build a Safe Sharing Pipeline
A practical implementation can be divided into five stages.
1. Collect and Validate
Gather information from approved sources and assess its reliability. Check the indicator's context, timestamp, confidence, and relevance before distributing it. Old indicators or unverified reports can create unnecessary noise.
2. Classify and Sanitise
Determine whether the item includes personal data, customer information, credentials, internal system details, or commercially sensitive information.
Remove unnecessary details before sharing. Where personal data is involved, assess the applicable GDPR requirements and consider data minimisation, anonymisation, or pseudonymisation where appropriate.
3. Approve and Share
Use an approved information-sharing arrangement. Define which roles may contribute intelligence, what requires additional approval, and which distribution restrictions apply.
Do not assume that information received from one community can automatically be forwarded to another. Follow the arrangement's rules and any handling markings attached to the intelligence.
4. Integrate Into Security Operations
Validate received indicators before adding them to SIEM, EDR, firewall, email security, or other detection systems. Use attacker behaviour reports to review detection coverage and adjust response playbooks.
Automation can improve speed, but validation and rollback procedures are important to avoid disrupting legitimate business activity through false positives.
5. Record the Outcome
Keep appropriate records of the information received, relevant approvals, significant actions taken, and any operational lessons. Review whether the shared intelligence improved detection or response.
Don't Forget the Legal and Governance Layer
Article 45 requires more than secure technical transport. The arrangement must protect business confidentiality and address personal data protection and competition policy.
Cyber threat intelligence groups should remain focused on security. Commercially sensitive conversations about pricing, customers, or market strategy are inappropriate for a cybersecurity-sharing purpose.
Where appropriate, arrangements should specify membership conditions, public authority involvement, the role of ICT third-party service providers, and the use of dedicated IT platforms.
Article 45(3) requires notification to the competent authority once participation has been validated and when it ends. Teams should coordinate with compliance or legal colleagues to confirm the applicable national notification process.
Article 45 Is Not Article 19
This distinction matters for incident responders. Article 45 concerns voluntary information sharing. Article 19 addresses the reporting of major ICT-related incidents and includes separate requirements. An entity must not treat sharing an incident indicator with peers as a substitute for required regulatory reporting.
What About ISO 27001 and Other Assurance?
A structured information security management system can support access control, incident management, supplier oversight, and documented procedures. Independent assessments may help evaluate whether these controls operate effectively.
However, DORA does not create an Article 45 certification. Any assurance evidence should be described accurately and considered alongside the organisation's own legal analysis and operational records.
Teams planning their broader regulatory controls can review these DORA compliance resources
A Short Implementation Checklist
- Identify approved sharing communities and review their written rules.
- Define permitted intelligence types and prohibited disclosures.
- Assign sharing, approval, and escalation responsibilities.
- Protect data in transit and restrict access to authorised recipients.
- Check personal data and confidentiality risks before distribution.
- Integrate validated intelligence into detection and response workflows.
- Maintain records of membership, notifications, and operational outcomes.
- Keep Article 19 reporting procedures separate.
Good threat intelligence sharing combines technical quality with legal discipline. When both are built into the workflow, financial entities can collaborate more effectively while maintaining control over sensitive information.
Top comments (0)