DORA Article 45 for Security Teams: Sharing Threat Intelligence Without Losing Control

Cybersecurity teams regularly share indicators, detection rules, vulnerability details, and attacker tactics. For financial institutions operating within the European Union, DORA Article 45 establishes a regulatory framework permitting voluntary sharing of cyber threat intelligence. However, exchanging this information requires careful consideration to ensure relevance, safety, appropriate arrangements, and usability by the receiving teams.

Article 45 of Regulation (EU) 2022/2554 enables financial entities to exchange cyber threat data, bolstering digital operational resilience. Since January 17, 2025, DORA regulations have been in effect. Useful information shared includes indicators of compromise (IP addresses, domains, file hashes), threat actor techniques, alerts on active campaigns, and defensive configuration guidance. Participation is voluntary, but entities must adhere to Article 45 conditions.

A practical sharing pipeline can be broken down into five stages:

1. Collect and Validate - Gather information from approved sources, verifying its reliability by examining context, timestamp, confidence, and relevance. Old or unverified indicators can generate unnecessary noise.

2. Classify and Sanitise - Identify if the shared item contains personal data, customer details, credentials, internal system specifics, or confidential business information. Remove unnecessary details; for personal data, apply GDPR requirements and consider minimisation or anonymisation.

3. Approve and Share - Use an approved information-sharing arrangement that defines who can contribute intelligence, what requires additional approval, and distribution restrictions. Do not assume transfers between communities are automatic; follow the arrangement's rules and any handling markings.

4. Integrate Into Security Operations - Validate received indicators before adding them to SIEM, EDR, firewall, email security systems, or other detection tools. Use attacker behaviour reports to review detection coverage and adjust response strategies. Automation can speed up the process, but validation and rollback procedures are crucial to prevent false positives from disrupting business.

5. Record the Outcome - Maintain records of the shared information, approvals, actions taken, and operational lessons. Evaluate whether the intelligence improved detection or response.

Legal and governance aspects are crucial. Article 45 requires more than secure transport; the arrangement must protect business confidentiality, address personal data protection, and comply with competition policy. Cyber threat intelligence groups should focus solely on security, avoiding commercially sensitive discussions. Notification to the competent authority is required upon validation and termination of participation.

DORA differs from Article 19, which deals with major ICT-related incident reporting. An entity cannot use sharing with peers as a substitute for required regulatory reporting. For those implementing ISO 27001 or other assurance frameworks, DORA does not provide certification but can be considered alongside legal analysis and operational records. Teams should review DORA compliance resources and follow a checklist to ensure proper implementation.