DORA for Pension Funds: What IORPs Need to Know About Digital Operational Resilience

A Sector Unprepared for ICT Regulation

Pension funds occupy a unique position in the financial sector. They manage enormous pools of capital — European occupational pension funds collectively manage trillions of euros — on behalf of millions of current and future retirees. Their investment horizons span decades. Their governance structures are often governed by social partner agreements. And their operational models are heavily outsourced: investment management to asset managers, custody to custodian banks, administration to third-party administrators, and technology to service providers.

DORA Article 2(1)(f) brings "institutions for occupational retirement provision" (IORPs) into scope. This means the same regulation that applies to global systemically important banks, central counterparties, and stock exchanges also applies to a Dutch company pension fund with 50,000 members, a German Pensionskasse, or an Irish occupational pension scheme.

The challenge is not that pension funds lack importance — the retirement security of millions depends on them — but that their organizational reality is fundamentally different from banks and insurers. Many IORPs have small in-house teams, heavily outsourced operations, limited technology budgets, and governance structures designed for investment oversight rather than ICT risk management.

DORA's proportionality principle under Art. 4 is critical here. But proportionality is not self-executing — pension funds must actively define what proportionate DORA compliance looks like for their specific risk profile.

The Outsourced Operating Model Challenge

The most significant DORA challenge for pension funds is not the ICT risk framework itself — it is the fact that most of the ICT risk resides with third parties, not with the fund.

DORA Art. 28(1) is clear: "Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework." The fact that ICT services are outsourced does not transfer the governance obligation. The pension fund's board remains accountable for ensuring that its third-party providers operate with adequate operational resilience.

This means the pension fund must:

• Know what is outsourced. Maintain a register of information under Art. 28(3) documenting all ICT service providers, the services they provide, and whether those services support critical or important functions.
• Contractual provisions. Ensure that contracts with ICT service providers contain the Art. 30 mandatory provisions: audit rights, incident notification, data location transparency, sub-outsourcing controls, and exit strategies.
• Ongoing oversight. Monitor provider performance, receive and assess provider incident reports, and validate that providers' own resilience practices meet the fund's requirements.

Mapping DORA to Pension Fund Reality

Pillar I: ICT Risk Management Framework (Art. 5-16)

Pillar II: Incident Management (Art. 17-23)

Pension funds must have an incident management process — but most ICT incidents will originate at their service providers, not within the fund itself. The fund's process must address:

• Provider incident notification. How does the fund learn about incidents at its providers? Art. 30 contractual provisions should require prompt notification.
• Impact assessment. When a provider reports an incident, the fund must assess the impact on its members and operations.
• NCA reporting. If the incident meets Art. 18 classification thresholds from the fund's perspective (member data breach, benefit payment disruption), the fund must report to its NCA.
• Member communication. If members are affected (delayed payments, data exposure), the fund must communicate — even if the root cause is at a provider.

Pillar III: Resilience Testing (Art. 24-27)

Proportionate testing for pension funds:

Pension funds are unlikely to be designated for mandatory TLPT — the designation criteria under Art. 26 focus on systemic importance. But proportionate testing must still be conducted: vulnerability scanning of own systems, backup restoration testing, and — critically — validation that providers conduct adequate testing of the systems they operate on the fund's behalf.

Pillar IV: Third-Party Risk (Art. 28-30)

This is the most important pillar for pension funds because third parties operate most of the fund's ICT infrastructure. The register of information and Art. 30 contractual provisions are the core deliverables.

The concentration risk assessment is particularly relevant for pension funds that use the same custodian, the same TPA, and the same asset manager for all their operations. If a single provider failure would disable all fund operations, that is a concentration risk that must be documented and assessed.

Pillar V: Information Sharing (Art. 45)

For most pension funds, Art. 45 information sharing is minimal. The proportionate response is awareness of threat intelligence relevant to the pension sector (through EIOPA publications and national pension supervisory communications) without active participation in sharing arrangements.

IORP II and DORA Interaction

IORPs are already subject to the IORP II Directive (Directive 2016/2341), which establishes governance, risk management, and information requirements. DORA supplements IORP II with specific ICT risk requirements.

The practical approach is to integrate DORA requirements into the existing IORP II governance framework rather than building a parallel structure. The own risk assessment should include ICT risk. The governance function should cover ICT risk oversight. The outsourcing governance should incorporate Art. 28-30 requirements.

Practical Roadmap

Use the DORA readiness assessment to evaluate your pension fund's compliance posture, review the proportionality guide for additional context on simplified implementation, and consult the glossary for regulatory terminology. The EBA/EIOPA guidelines provide the supervisory framework for pension fund operational resilience.

Conclusion

Pension funds face DORA from a position of significant outsourcing dependence. The regulation does not ask pension funds to become technology companies — but it does ask them to govern the technology that underpins their operations, even when that technology is operated by third parties. The proportionate approach is achievable: a documented framework, a provider register, contractual provisions, annual testing (primarily provider validation), and board reporting. The cost is measured in months of effort, not years. And the outcome is governance visibility into the ICT risks that could — if unmanaged — disrupt the benefit payments that millions of retirees depend on.

---

Resume en francais

Les institutions de retraite professionnelle (IRP) sont dans le perimetre de DORA en vertu de l'article 2(1)(f). Cet article cartographie les exigences de DORA vers la realite operationnelle specifique des fonds de pension — un modele fortement externalise ou la plupart des risques TIC resident chez les tiers (gestionnaires d'actifs, conservateurs, administrateurs tiers, fournisseurs technologiques). Pour chaque pilier, l'article definit la mise en oeuvre proportionnee : cadre de gestion des risques TIC integre a la gouvernance IORP II existante, gestion des incidents axee sur la notification des fournisseurs et l'evaluation de l'impact sur les membres, tests de resilience proportionnes (scan de vulnerabilites, test de restauration, validation des tests des fournisseurs), et gestion des tiers comme pilier le plus critique (registre d'informations, provisions contractuelles Art. 30, evaluation du risque de concentration). L'article propose une feuille de route pratique en cinq phases sur 10 mois, de l'evaluation des ecarts a l'etat stable.