Digital Operational Resilience Act (DORA)
Build your roadmap to DORA compliance with resilient and robust security, privacy, and compliance
About DORA
The Digital Operational Resilience Act (DORA) aims to establish a new benchmark for Information & Communication Technology (ICT) resilience across the EU financial sector. It applies to all financial sector entities operating within the EU: banks, investment firms, insurance companies, payment providers, crypto asset services, etc. and their third-party data and service providers like Snowflake.
Key Pillars of DORA
DORA consists of five key pillars: Information & Communication Technology (ICT) risk management, ICT third-party risk management, digital operational resilience testing, ICT-related incidents, and information sharing.
Snowflake's Approach to DORA
Snowflake enables DORA compliance with resilient technology, robust security measures, and tailored customer services, including certifications, audits and ongoing support. Additional DORA-related commitments for European financial institutions are outlined in Snowflake’s Financial Services Addendum. Customers can engage Snowflake’s compliance teams through dedicated consulting groups or raise concerns via SFDC Support for guidance on DORA.
The Snowflake DORA Customer User Guide and Financial Services Addendum (EMEA) are available upon request.
Please contact Snowflake and fill out the form on the right by selecting ‘Security Information’ as Inquiry type, or reach out to your Account Team for copies of reports as applicable to your organization or to find out if a particular certification will soon be available.
Data encryption
Snowflake encrypts data at rest using AES 256-bit (or better) encryption and leverages Transport Layer Security (TLS) 1.2 (or better) for data in transit to and from our platform. Snowflake's Bring Your Own Key (BYOK) model — known as Tri-Secret Secure — empowers customers to maintain complete control over their encryption keys, adding an extra layer of security.
Access control
Snowflake allows customers to define granular permissions for user roles, minimizing the risk of unauthorized access to sensitive data. Additionally, data can be classified and tagged based on its level of sensitivity, confidentiality or importance to the organization. This prioritizes security measures and simplifies data discovery.
Data governance
Snowflake offers a comprehensive list of data governance features. These include, but are not limited to, data masking, support for external tokenization and historical logging of user access history. These features further enhance the protection of customers’ sensitive data.
Data resiliency
Snowflake offers built-in fault tolerance and data replication supports continuous access to your data, even during hardware failures. Data is automatically replicated across different availability zones within the same region. If there's an issue, the system automatically fails over to another zone, minimizing downtime.
Digital operational resilience testing
Snowflake permits customer audits and penetration tests of their accounts in the Service. The Snowflake Service is also routinely audited by independent third-party auditors for compliance with various industry standards, including ISO 27001, SOC 1 Type II and SOC 2 Type II, and PCI-DCC, among others. Snowflake’s continuously expanding portfolio of supported security and compliance standards can be found here, Security & Compliance Reports.
Scalability
Snowflake can near instantly scale to meet planned, ad hoc, or surprise growth. This means instead of paying for a fixed, limited amount of storage and compute, the amount of storage and compute grows and shrinks as your needs change over time.
Account replication and failover
Available in Business Critical and Enterprise editions, Snowflake’s account replication and failover features allow customers to replicate their entire Snowflake account, including databases and metadata, to a separate account in a different region, providing a complete disaster recovery solution. Replication is configurable, allowing customers to recover their data to a specific point in time.
Third-party monitoring
Snowflake has an established vendor risk assessment program, which evaluates the operational resilience of its sub-processors annually and on an ad hoc basis. Snowflake customers may subscribe at the above link to receive advance notifications of new sub-processors.
Proactive security
Snowflake conducts frequent vulnerability scans and engages third-party security firms to conduct penetration testing of its platform. Snowflake also integrates with popular Security Incident and Event Management (SIEM) systems, allowing Snowflake customers to centralize security monitoring and receive alerts of suspicious activity.
In the event of a security incident, Snowflake will provide its customers with timely information about the nature and consequences of the incident, the measures being taken to mitigate it, and the status of their investigation as described in Snowflake’s Security Addendum.