DORA (Digital Operational Resilience Act) Regulation

DORA: How ROK Solution simplifies your compliance before the January 2025 deadline

⏳ The DORA Regulation Is Coming Into Effect Soon! On January 17, 2025, all financial institutions in the European Union will need to comply with the Digital Operational Resilience Act (DORA), an ambitious regulation designed to strengthen digital operational resilience against risks associated with information and communication technologies (ICT). However, according to a study conducted by the audit and consulting firm Grant Thornton, 75% of companies subject to DORA had initiated compliance work by the end of 2023, but most were still in the early stages of the process. At ROK Solution, we understand the challenges you face in ensuring the continuity of your operations and meeting these new requirements. This is why we have developed an intuitive, secure, and powerful platform to support you in achieving DORA compliance. What is DORA and why is it essential? The Digital Operational Resilience Act (DORA) establishes a common regulatory framework to ensure that financial institutions can withstand, recover, and continue their operations in the event of ICT-related disruptions. This regulation harmonizes digital resilience practices across the entire European financial ecosystem. DORA is essential because it: Strengthens digital security: Reduces vulnerabilities and IT risks. Protects the continuity of financial services: Ensures the resilience of critical services during crises. Harmonizes European practices: Establishes common standards to anticipate and respond to threats. Scope of application: DORA applies to a wide range of entities, covering over 18,000 financial institutions according to the EBA: Financial institutions: Banks, insurance companies, asset managers. Critical technology providers: Cloud service providers, SaaS, and strategic infrastructures. Fintechs and payment institutions: Innovative digital players integrated into the financial value chain. This scope ensures global resilience, addressing both internal and external dependencies. Main objectives: The main objectives of DORA are: Strengthen cybersecurity and reduce digital operational risks: Identify and mitigate vulnerabilities in ICT systems. Ensure the continuity of critical financial services by minimizing disruptions. Create a harmonized European framework: Standardize digital resilience practices across the sector. Enhance digital governance: Hold executives accountable for ICT risk management and ensure ongoing monitoring. Key requirements: According to the European Banking Authority (EBA), nearly 60% of companies affected by DORA were not yet compliant by the end of 2023. This exposes these organizations to costly operational disruptions and significant financial penalties. These fines can reach up to €10 million or 5% of total annual revenue, depending on the severity of non-compliance. ICT Risk Management: Identification, classification, and mitigation of critical vulnerabilities through dynamic controls and continuous assessments. Business Continuity: Development of robust plans and regular resilience testing with realistic scenarios (IT outages, cyberattacks). ICT Incident Monitoring: Proactive detection of incidents using metrics such as MTTD (Mean Time to Detect) and MTTR (Mean Time to Recover). Third-Party Supervision: Auditing and monitoring critical suppliers with a focus on risks related to the supply chain. Reporting and Traceability: Implementation of compliant dashboards (Excel, JSON, API formats) for tracking and reporting to authorities. Dedicated Governance: Involvement of executives in a proactive digital risk management strategy. How ROK Solution helps you meet DORA requirements 1. Mapping critical systems ROK Solution provides advanced tools to meet DORA requirements: Dynamic and automated mapping: Real-time synchronization with your existing IT tools such as CMDB (Configuration Management Database) or SIEM solutions. Identification of critical dependencies: Prioritization of mitigation plans through analyses based on dynamic scoring. Visualization of internal and external ICT flows: Enables optimized planning of continuity scenarios and impact assessments in case of disruptions. Auditable, compliant reports: Automatic provision of documents for internal and regulatory audits. 2. Simplified ICT risk management Our platform simplifies and automates proactive ICT risk management: Continuous assessment of vulnerabilities and threats with dynamic dashboards. Automation of corrective action prioritization to quickly address critical weaknesses. Generation of customized reports compliant with audits and DORA standards. 3. Business continuity and resilience testing With ROK Solution, create and manage robust business continuity plans: Preconfigured templates aligned with DORA standards to design your BCP/DRP plans. Realistic ICT crisis simulations with result analysis and improvement planning. Automated post-test reports to demonstrate compliance and track the effectiveness of actions. 4. Proactive incident monitoring ROK Solution ensures rapid and effective incident management: Advanced disruption detection: Integration of real-time monitoring tools with configurable alerts to minimize interruptions. Centralization of incident data: In-depth analysis and structured reporting for each event. Automation of corrective responses: Precise tracking of key metrics such as MTTD (Mean Time to Detect), MTTR (Mean Time to Recover), and MTTA (Mean Time to Acknowledge), ensuring continuous improvement in response times. 5. Supervision of critical ICT providers ROK Solution helps you manage your supplier relationships with optimized tools: Dedicated critical provider repository: Centralization of key information (performance, contracts, risk matrices) with dynamic tracking. Collaborative resilience testing: Coordination with suppliers to conduct shared crisis scenarios, including automated reports on their response capabilities. These scenarios are based on realistic simulations, such as critical system outages or targeted cyberattacks, and are co-developed with your suppliers to ensure a coordinated response. Continuous automated audits: Real-time monitoring of supplier compliance with DORA standards, including proactive detection of potential vulnerabilities in the supply chain. 6. Reporting and traceability ROK Solution simplifies the management of reporting obligations with: Interactive dashboards: Compatible formats (Excel, JSON, API) for seamless integration with existing systems. Real-time action traceability: Historical tracking of modifications and corrective measures for complete transparency during audits. Key performance indicators (KPIs): Measurement of critical timelines (MTTD, MTTR) to continuously optimize your resilience strategies. Why choose ROK Solution for your DORA compliance? An integrated solution: Centralize risk management, resilience testing, and supervision within a single platform. No-code technology assisted by generative AI: Configure customized workflows quickly, without requiring technical expertise. Accelerated compliance: Leverage ready-to-use templates to reduce deployment timeframes. Enhanced security: Ensure comprehensive protection of your sensitive data, compliant with European standards. Strategic collaboration: In partnership with SmartBot Consulting, benefit from advanced RPA and BPM solutions to optimize your processes. ROK Solution is one of the few platforms that combines centralized risk management, flexible no-code capabilities, and generative AI. This allows for the creation of

IMMERSION DIGITALE REX USF 2020

Rok presented on November 24, 2020 in collaboration with the company artimis the elis experience feedback on its use of rok for the automated management of its sap access rights as part of the rex usf 2020 digital immersion.

An expert’s view: The necessary revolution of current BPM models

Why are BPM tools having a hard time on the markets when they should be praised for anticipating change, promoting evolution, containing risks and transmitting knowledge? Business Process optimization and Management tools are not properly operated in times of growth, and thus cannot properly function in times of austerity Like a pendulum, companies oscillate, according to changing economic situations, between innovation and rationalization. We do not see many optimization projects being carried out in times of prosperity, when these would be very useful in more dire times. It is even rarer to see investments in this type of tools in times of crisis, due to lack of time, resources, or because its implementation would be too complex and time-consuming. Entrepreneurs share responsibility in this situation, but we should acknowledge in all fairness, that publishers have yet to offer truly efficient, evident solutions. Existing solutions are too complex, designed for experts and fail to satisfy company operatives. BPM tools all participate, in their way, in organization formalization, modeling, optimization, motorization, feedback enrichment… However, they all suffer from over-specialization, as well as overly complex integration, configuration, and maintenance. Designed by experts for experts, with feedback from experts or at least specialized consultants, these solutions fail to reach actual employees, and their “top-down” approach, for lack of simplicity and flexibility, can only be operated by a handful of top specialists. They remain dogmatically cooped up in IS or quality services acting like sanctuaries, and follow company mutations instead of anticipating or supporting them. Today, employees and operatives need simpler tools, which allow them to gain back control over organization structures and risks, while using and capitalizing collaborator knowledge. It is high time we reconciled top white collars with other employees, but also Information Systems with the people operating them, by providing simpler, task-oriented, transversal tools that can be easily set up and used by everyone, giving managers new control over their department’s organization. Current models need to be redesigned. Organization structures need to be described and normalized simply, without needing to overwrite existing capitalized knowledge, even if it exists on multiple, seemingly incompatible platforms. Structures need to be accessible to everyone, for information and operation. A three-way solution: redefining IS management rules, associating risks and projects, federating staff and promoting task synergy throughout the company Information needs to be transmitted and shared naturally and effortlessly, which implies completely redefining old management paradigms that waste precious time by focusing on individual and group rights managements. Common sense dictates that this task should follow organic and systematic company rules. Risk must be a constant considered alongside an evolving organization structure, and we should have tools allowing to manage and contain them at all times. Finally, in order to exist and be sustained, organization management tools must not be isolated. They should communicate with the IS or HR services, support document and content management, and be used by all relevant services. The broader their reach, the better their performance, reactivity and efficiency. Conclusion BPM tools do have a promising future, provided they undergo a triple revolution. Once only for experts, they must become collaborative, contributive, even social, and should be manageable by operative staff, so that the added value coming from specialist and consultant knowledge may become the (high value) tip of the iceberg, instead of the submerged part, like it is today. Content integrity and control must not be handled by the IS, but rather supported by risk analysis, which must be integrated to the solution. Conserving their inherent specific expertise, these tools must be able to capitalize and distribute knowledge from and to everyone involved. When this revolution finally unfolds, assisted organization optimization will finally become the norm, whatever the economic situation may be. Such tools will allow to anticipate and support change, while managing subsequent risks, and making best practices available. They will finally gain popularity and spread to many sectors. They will be praised for their efficiency, their usefulness, and their obvious, immediate Return On Investment. This is about concept, technology, and models.

Software publishers: a “pure player” strategy

In today’s tense economic climate, IT industry professionals are looking for new organizational models allowing them to rapidly develop market shares and deepen their competitive edge. In this context, many approaches coexist with various positions, among which we can count direct sales, indirect, and mixed models. In this document, differences between each model will be explained, and we will see how a 100% indirect approach can lead to high value creation. The direct approach, traditionally used by leading publishers on the market, consists in integrally carrying out a project without the services of a consulting firm or integrator. This approach is very widespread on the other side of the Atlantic and less present in Europe. One can note it hardly fits strategies of smaller and medium-sized publishers, who do not have the necessary financial resources or “moral guarantee” of bigger publishing groups. Moreover, in times of crisis, this approach appears more limited, particularly for projects where specific business impact is at the heart of company challenges. The direct approach fits “transversal” technology better, since those require little to no configuration or added value. Installation and support can then be taken care of by in-house teams. The mixed approach consists in combining direct and indirect sale strategies throughout partner networks. Generally, we can observe that greater accounting projects are traditionally carried out by publishers, and that mid-market and SME projects are handled by indirect networks. Most of the time, medium sized publishers choose this approach, willing to complement their own teams with technical and commercial partners who allow them to access new opportunities on mid-market segments. What makes this approach difficult is the frontier between direct and indirect approaches, as well as managing a partner network that only handles parts of the projects (oftentimes the most time-consuming and least profitable aspects). In order for this approach to work, solid network incentive policies need to be established. The “pure player” approach is a 100% indirect strategy. Publishers focus on their own tasks: publishing software. Commercial development is handled by a partner network consisting of integrators, consulting firms and others. This strategy allows the network to generate high added value for their clients. This approach is particularly fitting for publishers who wish to provide solutions integrating business and organization specificities for each potential client company. The business and task-specific side of the project is then provided by partners thanks to the publisher’s platform, in order to deploy custom-made applications. Thanks to this model, relations between publisher and partners go beyond simple marketing partnerships, and lead to long-term industrial collaboration. An important aspect to consider is selecting partners very carefully. Partnership quality, more than quantity, is a crucial strategic element of this approach. Let us not forget that partners need to be supported and accompanied overtime, through formation, meetings, and network management. Investing time and resources to establish successful partnerships and letting partner sales managers get to know your solution is fundamental. Considering these three sales models, we can notice that many publishers tend to focus on the publishing side of their business, rather than service. Undoubtedly, this approach should soon garner popularity and integrators deliver high added value, which can be explained by the evolution of company demand, with clients expecting solutions to be more and more polished and adapted to their specific business challenges. Olivier BOURROUILH, ROK Solution CEO

ROK Solution and the ROK Store: a Collaborative Intelligence Revolution

ROK Solution, publisher of a collaborative intelligence solution that helps structure and share company know-how efficiently, announces ROK version 3. Far from stopping there, ROK presents their ROK Store, which will allow companies to access business reference sheets relevant to their sector, and integrate them in real time. ROK 3.0 combined with the ROK store makes the cornerstone of a highly-operational offer, dedicated to performance optimization for companies and their collaborators. A groundbreaking new concept Collaborative intelligence aims to allow company collaborators to pool their knowledge and know-how to carry out projects or optimize their daily workflow. For such a system to work, heterogeneous information and expertise need to be combined, structured, organized, and shared efficiently. Designed for company operatives, ROK’s platform puts end-users back at the heart of their approach and allows to capitalize on immaterial company assets so as to improve performance and flexibility. The platform’s organic and systematic approach, which uses patented algorithms, allows users to navigate various departments and hubs in their company. These tools allow them to collaborate easily and transparently with anyone in their work environment. ROK helps generate the synergies required to carry out company projects. A unique user experience By getting rid of conventional navigation bars and drop-down menus, ROK seeks to redesign management tools. Users are organically immersed in their work environment. ROK’s interface offers a new vision of Human-Machine Interaction. This innovation allows to consider the human side of organization. IS rights management is automated, and document transfers are completely secure, making processes only accessible by the relevant collaborators. Users are instantly recognized by the platform, making it unnecessary to browse contextual menus. All the necessary information comes to the relevant users without them needing to spend a minute looking for it. ROK Store, immediate access to business reference descriptions ROK goes beyond the platform itself and follows through, announcing the ROK Store. ROK Store allows to instantly integrate specific references, as well as business and sectorial know-how, adapt it to specific needs, and deploy it in a structured, operational manner. ROK Store also allows consultants and experts to share knowledge with all platform users, who can in turn access a number of applications, free or paid, in order to structure their own organization. More than a simple database, ROK Store is a true pool of high-potential business knowledge, which can be directly integrated as a ROK app. ROK Store puts an end to operation managers’ nightmares, sparing them the need to start new projects completely from scratch.

ROK Solution slated for French Tech Tour ’12.

ROK Solution, publisher of a Collaborative Intelligence platform, has been selected to attend the famous French Tech Tour 2012. For ROK, this is a year of innovation and consecration, as success and awards keep piling up: 1st place Microsoft Finance Innovation Award, successful fundraisers, and now tickets for the French Tech Tour 2012! For this event, ROK will benefit from a few advantages: Meeting preparation and coaching with American professionals. Several workshops to get a better picture of how business is done in the United States One-on-one meetings with the most relevant potential partners, among major American and global companies Several networking events organized in the Silicon Valley Olivier BOURROUILH, ROK Solution CEO: “I am delighted to have been selected for this event, among the best IT industry professionals in France. The interest that American businesses have shown for our solution proves our position as innovators on the market and will allow us to shake hands with American giants. This will open the door to new synergies and a great potential for growth.”

Competitiveness “for Dummies”, a message from the CEO

Going back to Olivier Bourrouilh, ROK Solution CEO’s column on French newspaper lecercle.lesechos.fr In a global market economy, being competitive is no longer an option, it’s about survival. “I strongly reject shortcuts and simplifications of a somewhat political and controversial nature, which tend to undermine the issue, limiting it to a question of costs, financial, legal or custom-related protection. I reject this because survival is at stake; the situation is more than urgent and actions need to be taken. I reject this because there are tools and technology available that would quickly allow us to gain a competitive edge. But in order to deal with a threat, or better yet, use it to our advantage, we must perform a proper diagnosis. We are talking about competitive advantage here, nothing more but nothing less either. This involves markets, products and technology. Provided you haven’t already used methods like absorbing or taking out your competitors, you must consider these two: innovation and optimization. There is no alternative. Innovation is in my opinion the best method. It consists in delivering a unique and relevant service, which comes from successful R&D, with relatively high prices, margins, and shielded by patents and other protections. Lower margins were once exclusive to industrialized countries. When emerging countries entered global markets, they conveyed lower budgets and considerably weakened competition, in a very short time. Succeeding in innovation rarely consists in only waiting by a tree for apples to fall on your head. Innovating may be a costly endeavor, but above all, I think it happens thanks to well-structured, coordinated, documented collaboration which is closely monitored in real time and optimized with feedback. The Web was invented by researchers who needed to communicate to make progress and succeed; today we see collaborative solutions appear, that allow dynamic organization and online collaboration, conveying necessary information and methods, automating the learning process, and transmitting data via voice, image and text. These solutions are efficient when they rest on Cloud technology and user-friendly, even vector interfaces, opening the way to new, scalable navigation. Innovating at low costs today is possible, and it is new. This kind of innovation has more to do with (collaborative!) intelligence than investments. The second method is about optimization, but in a broader sense than only unit costs indicators. Costs are a sensible matter, undoubtedly, but have you never, as a manager, had to deal with ignorant, incompetent, unreactive, or even outright lazy collaborators? Have you ever considered what profit could amount from optimizing the way collaborators work by only 5 or 10%, instead of laying employees off in equal proportions, losing potential value in the process? Optimizing organization structures, sharing and capitalizing on knowledge -from the company as well as its ecosystem- was often a moot point, because it rested on complex tools (BPM, BPA, WF, CM, KM and so on) that were hard to set up, integrate, share and adapt to your company’s obvious mutations. Today, solutions exist and they are integrated, scalable thanks to Cloud technology, and they feature accessible interfaces. They can be quickly implemented, you can adapt costs to your requirements thanks to the SaaS model, and they are immediately operable. It is very frustrating to see we have immediate solutions available but do not use them; because in doubt, it may be easier to believe the solution doesn’t entirely depend on us. The available technology has evolved formidably. Younger generations are already adopting them completely, for fun. Let us take time to reconsider our old reflexes, look at the situation from a higher angle, and embrace this new challenge that web tech advances offer us. After the “web springs”, let us be actors of this competition strategy revolution.” Author’s note: “Just imagine what could happen to DMV administration waiting lines if we put these solutions at their disposal…” Olivier Bourrouilh, ROK Solution CEO

ROK Solution raises 1.5 Million Euros

ROK Solution manage to entice new investors and finish their fundraiser with 1.5 Million Euros. Thanks to support from both newer and older investors, ROK Solution aim to boost their growth and deepen their competitive edge, by entering the American market. Collaborative Intelligence aims to allow company collaborators to pool together their know-how, in order to carry out projects or optimize their daily workflow. Such a system relies on combining, structuring, organizing and sharing heterogeneous information and expertise. The ROK platform was designed with this requirement in mind, without having to use multiple tools. Built for policy and decision makers, the platform puts end users back at the center of their own approach and allows to capitalize on non-physical company assets to increase performance and flexibility. ROK is the first all-in-one solution on the market to integrate BPA, BPM, CRM and BAM on a unified 2.0 communication platform. Olivier Bourrouilh, CEO and creator of ROK Solution: “We are proud to announce this new fundraiser, which will help us strengthen our references before we enter the American market. Our unique technology has reached maturity and has received many awards and praise. The entire ROK Solution team is mobilized to carry out our new development plan. Our solution is the only one on the market that can truly act as a performance enhancer.” ROK Solution is determined to keep a leading position on this thriving market. Read article Read article Read article Read article Read article Read article Read article

Back to “Digital: Year One”

On May 12th, 2015, ROK Solution invited 200 company managers and partners to their conference called “Digital: Year One”. Many exceptional speakers have taken the floor to share their experience, views, and advice. The main theme, Company digitalization, is one of the most high-stakes and pressing matters for professionals in 2015. Not only is it a path to profitable growth that proves to be both reliable and relevant, but also inevitable. Current mutations in economic models are redefining capitalistic balance Gilles Babinet, Digital Champion for France at the European Commission, starts the conference with his analysis of company digitalization around the world, and more specifically in France: Yes, company digitalization has indeed begun, but with a wrong start. Major actors have failed to anticipate the magnitude of this revolution before the rise of sizeable competition. Thus, AirBnB owns no hotels, yet sells more nights today than the five biggest hotel networks in the world. How can we make companies digital? One word: PLATFORM. Digital Companies no longer have an Information System; they have become their own IS. The platform grants flexibility and ease of use. The consequence of this fast evolution is a drastic anthropologic shift that leaves the main actors on the market frightened: company silos are broken, hierarchy structures are flattened down, teams of ten gather around pizza in open space offices… Going digital will make large-scale industrialization possible for your company in any and all sectors, helping optimize processes, report KPI in real time, promote innovation, in other words, become more efficient and competitive. But this digital revolution process is currently lagging behind in France (15th country out of 28 according to a European study). Investments are clearly below what we see in other OECD countries. Why is that? Data culture has not yet settled in France, return on investments for digitalization processes are not known in advance, taxation on risk capital can prove discouraging. And yet, France has seen a few companies break through, albeit too rarely. Cisco CEO John Chambers decided to invest in France after seeing impressive French innovations presented at the CES in Las Vegas. How can we popularize company digitalization in France? Raising Top and Middle Management awareness on the matter, learning how to tell value proposition and onboard technology apart, promoting innovation funding, and introducing data culture into the organization are all crucial steps to this transformation, and it is essential for France to follow them in order to remain a top player. ROK, the perfect solution for digital transformation leaders Daniel Gaujac, Partner for DigitasLBi, the first digital global agency, steps on stage next. DigitasLBi is proud to count Amazon, Google, Coca-Cola Company, American Express, LVMH Group and many others among their clients. Daniel Gaujac delivers an expert statement on what makes ROK Solution the perfect tool to help your company go through its digital transition: ROK Solution works as an App generator. Their concept is to work in synergy with businesses, and allow companies to design the app they need in a simple, intuitive, and time-efficient way. They can then benefit from increased efficiency, optimized processes, automation for time-consuming tasks with no added value, and so on. Two examples: Dirigeants & Partenaires have developed the Gold Mine app, and BearingPoint have created their Asset-Based Consulting branch. What about the costs, then? What are the numbers? Nil. Zero development costs, no maintenance expenses, no additional IT Management costs. The Digital Revolution is now accessible without the need of a multinational-size budget. Décathlon have developed an app for accounting closure in 4 man-days, which allowed them to save 35 000 emails worth of manpower, amounting to 200 man-days. ROK is a Cloud-native solution. ROK was not adapted or ported to the cloud; it was born from Cloud technology, and has been developed natively on it. As a consequence, deploying ROK and developing apps on the platform offers virtually limitless possibilities, both in terms of numbers and adaptability. Collaborative Intelligence is emerging. The benefits of designing your own app do not stop at process optimization. It also allows new offers to emerge quickly, such as BearingPoint’s Asset Based Consulting (detailed below in Erik Campanini’s intervention). As far as IT Management is concerned, ROK Solution bolsters your present software infrastructure with the power of cloud computing and increases visibility on who does what, how and with which tool, dynamically and in real time. The platform also enhances mobility on the entire structure. Daniel Gaujac finished his intervention by highlighting the “Made in France” aspect of ROK Solution, but also showed ROK was the only platform dedicated to company digitalization available on the market today. Dirigeants & Partenaires – Gain a competitive advantage through digitalization. ROK Solution, a new game changer on the market. Kevin Barrett, President of Dirigeants & Partenaires then took the floor, seconded by Alain Portmann, Partner in the same company. Dirigeants & Partenaires aims to support career change for high-level executives through personalized coaching and networking solutions. They mention the benefits of the Gold Mine app, which they have designed in ROK Solution, and explain why this platform is the market’s new game changer. Dirigeants & Partenaires (D&P) deals in the highly competitive market of Outplacement. They aim to stand out by providing a highly qualified, easily accessible professional network to their clients. In order to achieve this, after having been disappointed by available tools and solutions, D&P chose to develop their own professional networking app on ROK Solution’s platform. And so the GoldMine app was born. When you look for a job, you need to start by asking yourself three questions: Who is the right person to get in touch with? Who must I contact to get to this person? What is the best plan to follow to reach them? In order to answer these questions accurately, a great deal of research and database cross-referencing often needs to be done, along with the risks inherently conveyed by the sheer amount of data involved. GoldMine was designed to simplify

Category: Press