Cyber-Management
EN / FRbook a consultation

DORA

DORA compliance for financial firms and their IT suppliers.

Financial firm, or IT supplier to one? See what DORA changes for you.

book a free 25-minute consultation

Does it apply to you?

Three questions to see where you stand.

Yes to the first: DORA applies to you directly. Yes only to the second or third: it reaches you through your contracts. The exact tests are in the section for your IT manager, below.

  • Are you a regulated financial firm?Bank, insurer, investment firm, payment or e-money institution, crypto-asset provider, fund manager. Most are covered whatever their size, with lighter rules for some small firms.
  • Do you sell IT services to one?Cloud, software, hosting, managed IT, payment processing. DORA does not apply to you directly, but your clients must put its clauses into your contract.
  • Has a bank or insurer sent you new contract clauses?Audit rights, incident alerts, exit plans. These come from DORA. Knowing which are required helps you sign without over-committing.

Not in scope?

Not a financial firm? Your clients are.

Banks and insurers must keep a register of their IT suppliers and put set clauses into every IT contract: audit rights, incident notification, continuity and exit plans. Being ready for those clauses keeps renewals moving.

how we answer customer questionnaires

What changes for you

Management answers for IT risk, and incidents are reported fast.

If DORA covers you, your management body approves and oversees how IT risk is managed, and stays responsible for it. A major IT incident must be reported to your regulator, with a first report within 4 hours of classifying it as major.

You also need yearly testing of the systems behind your critical functions, a register of all your IT suppliers, and set clauses in their contracts. Firms identified by their regulator also run advanced, threat-led penetration tests every three years.

The real risk is a supervisory finding that slows your business, or a contract you cannot renew. The fix is a short plan, in the right order, with evidence you can show. If you already hold ISO 27001, much of the base is there.

What to do first

Confirm what applies, then close the gaps that matter.

What we deliver

  • A documented answer: in scope or not, full or simplified rules, or reached through your contracts
  • Your gaps across the five DORA areas, ranked by risk
  • An incident process that meets the 4-hour first report
  • Your IT supplier register and contract clauses, or, as a supplier, your answer to them
  • A yearly testing programme, and preparation for advanced tests if your regulator asks

Who does what

We lead the DORA work. Your IT team keeps the technical side.

What we lead

  • Work out how DORA applies to you
  • Rank the gaps and set the plan
  • Write the IT risk framework and the incident procedure
  • Structure the supplier register and review contracts
  • Design the testing programme and report to management

What stays with your IT provider

  • Set up logging, backups and access controls
  • Carry out the tests with your testers, and fix what they find
  • Keep the supplier register up to date

We check their work against the plan, so the evidence holds up with your regulator.

How it starts

Your first step: the DORA Scope & Gap Sprint.

You get a documented answer on how DORA applies to you, as a financial firm or as an IT supplier, and which gaps to close first. The fee is fully deducted if you continue with us within 60 days.

From
€4,900excl. VAT
Duration
15–20 business days
Your time
3–8 short interviews

Fixed price, set by your headcount.

book a free 25-minute consultation

Start the DORA assessment

For your IT manager, DPO or CFO

What DORA requires in practice.
  1. 01Pillar 1

    ICT risk management framework

    A board-approved ICT risk management framework covering identification, protection, detection, response and recovery — with management responsibility throughout.

  2. 02Pillar 2

    ICT incident classification & reporting

    Mandatory reporting of major ICT incidents to the competent authority on a 4h / 72h / 1-month cadence, plus voluntary notification of significant cyber threats.

  3. 03Pillar 3

    Digital operational resilience testing

    At least yearly testing of the ICT systems supporting critical or important functions (microenterprises excluded); threat-led penetration testing (TLPT) every three years for the entities your competent authority identifies, run by testers that meet Article 27 requirements.

  4. 04Pillar 4

    ICT third-party risk management

    A register of information covering every ICT third-party arrangement (Article 28(3)), mandatory contract provisions (Article 30, with extra ones for services supporting critical or important functions: audit rights, exit plans, subcontracting controls), and ongoing oversight.

  5. 05Pillar 5

    Information sharing

    Voluntary participation in cyber threat intelligence and information-sharing arrangements between financial entities — reciprocal, structured exchange of indicators of compromise and threat intelligence.

National penalties and direct supervisory powers.

For financial entities, DORA does not set fine amounts: each Member State lays down administrative penalties and remedial measures that must be effective, proportionate and dissuasive (Article 50). Supervisors can order a practice to stop, require corrective measures and publish notices naming the firm and the breach, and national law can extend penalties to members of the management body. Critical ICT third-party providers designated at EU level face a separate regime: periodic penalty payments of up to 1% of their average daily worldwide turnover, imposed daily for up to six months (Article 35).

  • Financial-entity penalties

    National

    set by each Member State — effective, proportionate, dissuasive (Article 50).

  • Critical ICT provider

    Up to 1% / day

    of average daily worldwide turnover, for up to six months (Article 35).

  • Major incident reporting

    4h · 72h · 1mo

    initial / intermediate / final — significantly faster than GDPR or NIS2.

Typical timeline

Depends on baseline — existing EBA-aligned controls help.

  1. 3–6 months

    From an EBA-aligned or ISO 27001 baseline

    DORA-specific deltas: third-party register, Article 30 contract uplifts, 4-hour notification process, formalised ICT risk framework. ISO 27001 is a strong starting point but does not cover these DORA-specific items.

  2. 9–12 months

    End-to-end including TLPT readiness

    Full programme: we design the framework, register, contract clauses, incident processes and testing programme, and prepare you for a first TLPT if you are identified; your IT team, provider and testers carry out the technical work and tests.

FAQ

What IT managers, risk and compliance teams ask us about DORA.

Exactly who does DORA apply to?
DORA is Regulation (EU) 2022/2554, applying since 17 January 2025. It covers EU financial entities: banks, insurers, investment firms, payment and e-money institutions, crypto-asset providers and fund managers, with payment institutions covered whatever their size. Microenterprises (fewer than 10 staff, turnover and/or balance sheet up to €2M) get lighter rules, including exclusion from TLPT. Article 16 sets a simplified framework for named entity classes, such as small non-interconnected investment firms and payment and e-money institutions exempted under EU payment law. ICT providers designated critical by the European Supervisory Authorities are overseen directly at EU level.
Does DORA apply to our ICT suppliers even if they are not financial entities?
Yes — directly to critical providers (with EU-level oversight), and indirectly to non-critical providers through the contractual obligations their financial entity clients must impose. Non-critical providers must accept Article 30 provisions: audit rights, incident notification, business continuity commitments, exit plans.
We already comply with EBA ICT guidelines — are we DORA compliant?
No. EBA Guidelines are a strong starting point but DORA goes significantly beyond them in three areas: threat-led penetration testing (TLPT) every three years for the entities the competent authority identifies, the Article 28(3) register of information and the Article 30 mandatory contract provisions, and the specific 4h/72h/1mo incident reporting cadence with quantitative classification thresholds.
What's the difference between basic and advanced (TLPT) resilience testing?
Basic testing runs at least yearly on the ICT systems supporting critical or important functions (microenterprises excluded): vulnerability assessments, scenario-based tests, network and physical security reviews. TLPT is required every three years only for financial entities their competent authority identifies, on impact, systemic and ICT-risk criteria; microenterprises are excluded. It runs against live production systems with real threat intelligence, by testers meeting Article 27 (external, or internal with the authority's approval and an external tester every third test). Results go to the authority; findings must be fixed.
How does DORA's incident reporting differ from GDPR and NIS2?
DORA requires an initial notification within 4 hours of classifying an incident as major — significantly faster than GDPR's 72-hour breach notification and NIS2's 24-hour early warning. DORA's classification uses quantitative impact thresholds. A single incident may trigger all three frameworks simultaneously; we design integrated incident processes that satisfy each timeline.
Does DORA apply if we are a small payment institution?
Yes. Payment institutions are covered by DORA regardless of size. DORA itself gives microenterprises (fewer than 10 staff and turnover and/or balance sheet up to €2M) lighter rules, including exclusion from TLPT, and payment institutions exempted under EU payment law follow the simplified framework of Article 16 — but incident reporting and the Article 30 contract obligations still apply.
How does DORA interact with the EU AI Act?
Many financial firms use AI in core operations. Credit scoring of natural persons is Annex III high-risk under the EU AI Act (point 5(b)), so Article 26 deployer duties sit on top of DORA’s ICT risk requirements. Fraud detection is expressly carved out of that point, and AML screening is not listed at all. DORA is also the lex specialis for the sector: NIS2 generally does not apply to the financial services of DORA-covered entities.
How long does DORA compliance take to implement?
3–6 months from an EBA-aligned or ISO 27001 baseline (closing DORA-specific gaps); 9–12 months end-to-end including TLPT readiness. DORA has applied since 17 January 2025 and supervisory inspections are underway, so this is no longer a planning exercise — most engagements run on tight client-driven deadlines.

Related

Adjacent obligations.

ISO 27001

A strong base for DORA's ICT risk-management, incident and access-control requirements.

Read more

ISO 42001

For DORA-covered entities running AI in ICT operations (credit scoring, fraud detection, AML screening), the AIMS layers AI-specific governance on top of the DORA ICT risk framework.

Read more

EU AI Act

Financial entities using AI in ICT operations — credit scoring, fraud detection, AML screening — layer AI Act deployer duties on top of the DORA ICT risk framework.

Read more

NIS2

Generally inapplicable to financial services activities of DORA-covered entities (DORA is the lex specialis).

Read more

EU GDPR

DORA's data security obligations overlap with GDPR Article 32; integrated incident processes serve both.

Read more
back to compliance hub