DORA and secure file sharing
Control the exchange. Demonstrate the safeguards.
Client records, audit documents and supplier information cross your organisation’s boundaries every day. Msafe Secure File Transfer helps you control access and retrieve relevant activity. This supports a specific part of your wider approach to DORA.
Access control • Protected exchange • Audit trails
From a confidential file to controlled access and a traceable audit trail.
Support, not automatic compliance
DORA extends beyond file sharing. Your organisation remains responsible for risk management, continuity, incident handling, testing and arrangements with ICT service providers.
THE CONTEXT
How does DORA relate to file sharing?
The Digital Operational Resilience Act (DORA) has applied since 17 January 2025 to financial entities within its scope. These include banks, insurers and certain other financial businesses. The precise obligations depend on factors including the type of entity and the applicable proportionality regime.
DORA does not prescribe a particular file sharing application. It does require in-scope organisations to manage ICT risks. For external file sharing, this raises practical questions: who receives access, how is the information protected, and what can you reconstruct afterwards?
17 January 2025
DORA applies
FAMILIAR EXCHANGES
Where confidential information leaves your organisation
01
Client and onboarding records
Share only the documents needed for the purpose. Decide who should receive access and when that access should end.
02
Audit and reporting documents
Be clear about the documents you share with an auditor or supervisory authority. Record the access conditions and relevant activity.
03
Supplier and incident information
Limit the information to what the service provider needs. Agree what should happen to the copies they receive.
FROM REQUIREMENT TO PRACTICE
Which controls can Msafe support?
The mapping below is a practical application to file sharing, not a complete DORA checklist. Select controls based on your risk assessment and test how they work in your own environment.
ARTICLE 9
Limit access
Reduce the risk of a file reaching more people than necessary.
Practical control
Use recipient verification, appropriate permissions and an expiry date. Msafe supports these access conditions and the ability to revoke access.
Evidence to assess
Review the sharing policy, the applied settings and relevant access activity. Establish who is authorised to grant permissions.
ARTICLE 9
Protect the exchange
Manage the risk of unwanted disclosure or unprotected transfer.
Practical control
Msafe supports encrypted file exchange. Combine this with information classification, data minimisation and a verified recipient.
Evidence to assess
Test the security configuration and the chosen use case. Encryption alone does not demonstrate that the whole process is appropriately configured.
ARTICLES 10 AND 17–19
Enable investigation
Without useful records, it can be difficult to establish what happened.
Practical control
Use relevant file activity records in investigations. Msafe provides audit trails and export capabilities; your incident process handles assessment and any required notification.
Evidence to assess
Combine event records with an incident record, impact assessment and documented decisions. Test which events your configuration actually records.
ARTICLES 24–25
Test the controls
A configured control may work differently in practice from what you expected.
Practical control
Test an external transfer, the expiry or revocation of access and the retrieval of activity records. This is a task for your organisation.
Evidence to assess
Keep test scenarios, results, identified issues and corrective actions. A file sharing test does not replace your wider DORA testing programme.
Fit the controls into everyday work
Outlook integration, Single Sign-On with Microsoft Entra ID and user provisioning through SCIM can support adoption in everyday workflows. These integrations are included in Enterprise and Unlimited; configuration depends on your environment. Explore Msafe Secure File Transfer
FROM ACTIVITY TO EVIDENCE
Can you reconstruct what happened to a file?
An audit trail provides insight into recorded events. An assessment becomes stronger when you connect those records to the settings and agreements that applied to the exchange.
Policy
Why was this recipient allowed to receive this information? Who approved the exchange?
Configuration
Which verification, permissions and validity settings applied? Have these settings been tested?
Events
Which file activities were recorded? Are the records useful for your investigation?
Revocation is not retrieval
Revoking access prevents future access through Msafe. It does not remove a file that the recipient has already downloaded to their device. Also agree how copies, confidentiality and deletion will be handled.
ICT THIRD-PARTY RISK · ARTICLES 28–30
The service can be outsourced. Accountability cannot.
A protected transfer does not replace a supplier assessment. Also consider the role of the service, the contractual arrangements and the consequences of an outage or termination.
01
Classify the dependency
Determine whether the ICT service supports a critical or important function. That assessment matters for the required arrangements and controls.
02
Assess the arrangements
Consider service delivery, data locations, security, incident assistance and termination. Critical or important functions require additional provisions, including appropriate audit and access rights.
03
Plan for continuity and exit
Document who is responsible, how you can recover your data and how the process can continue when the service is unavailable or ends.
An audit trail is not the DORA register of information
The DORA register of information concerns contractual arrangements for ICT services. A file log records events involving files. They serve different purposes and do not replace each other.
A PRACTICAL NEXT STEP
Start with one real exchange
Use a recurring process as your starting point, such as transferring a set of documents to an external auditor. Review it with IT, security, compliance and the process owner.
01
Define the conditions
Which information, purpose and recipient? How long should access last?
02
Test the experience
Can an employee share in accordance with policy, and can the intended recipient open the documents?
03
Assess the evidence
Can you retrieve the applied settings and relevant activity? What additional agreements are needed?
FREQUENTLY ASKED QUESTIONS
DORA and file sharing:
the key answers
FROM POLICY TO EVIDENCE
Put your own file exchange controls to the test.
Discuss one specific use case. Explore how access, usability and audit information align with the safeguards your organisation needs.
Explore the official guidance
The mappings on this page are informed by DORA and guidance from European and Dutch supervisory authorities.
This page provides general information and is not legal advice. Assess the applicable obligations and your configuration with your own advisers.
Content reviewed on September 2026.