DORA compliance assessment

What is DORA?

DORA (Regulation (EU) 2022/2554) is a directly applicable EU regulation. Unlike a directive, it needs no national transposition, so the same rules apply across all Member States. It is supported by regulatory technical standards, for example on the ICT risk-management framework and on incident reporting.

DORA is built on five pillars:

• ICT risk management: a documented framework approved by the management body, which holds final responsibility;
• ICT-related incident management and reporting: classification of incidents and reporting of major ones to the competent authority;
• Digital operational resilience testing: a risk-based testing programme and, for significant entities, threat-led penetration testing (TLPT) at least every three years;
• ICT third-party risk management: a register of information on all ICT contracts, mandatory contract clauses and exit strategies;
• Information sharing: voluntary exchange of cyber threat intelligence.

Who must comply?

DORA covers around 20 types of financial entities, including credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, insurers and reinsurers, pension funds, fund managers and crowdfunding platforms. Smaller entities may apply a simplified ICT risk-management framework.

ICT third-party service providers are affected too. Their financial customers must include DORA clauses in contracts and monitor the provider’s resilience. Critical ICT providers are overseen directly by the European Supervisory Authorities.

What does the assessment cover?

We assess your organisation against each DORA pillar:

• ICT risk-management framework, governance and management body oversight;
• asset identification, protection, detection, response and recovery;
• backup policies, restoration and business continuity;
• incident classification, handling and reporting procedures;
• the resilience testing programme and how test results are acted on;
• the register of information, contract clauses, concentration risk and exit plans;
• training and awareness for staff and management.

For ICT service providers, we assess readiness to meet the requirements financial customers pass down through contracts.

How does it work?

1. Scoping: entity type, proportionality, critical or important functions and the ICT services supporting them.
2. Document review: ICT risk framework, policies, register of information, incident and testing records.
3. On-site or remote assessment: interviews and evidence sampling.
4. Report: findings per DORA requirement, rated by compliance level, ready to share with your management body and supervisor.

As an independent body, we assess and report; we do not design your framework or perform penetration tests.

DORA, ISO 27001 and ISO 22301

An ISO 27001 information security system and ISO 22301 business continuity system give a strong base for DORA. DORA goes further with incident-reporting rules, the register of information, specific contract clauses and resilience testing. The assessment shows exactly where your certified systems already meet DORA and what is missing.

Why choose a DORA assessment?

By choosing a DORA compliance assessment, you will:

• have an independent view of your compliance before supervisory review;
• give your management body evidence to fulfil its oversight duty;
• find gaps in third-party contracts and the register of information;
• as an ICT provider, show financial customers that you are ready for DORA;
• reuse the work already done for ISO 27001 and ISO 22301.