Your register came back with errors
It was assembled from procurement spreadsheets, the authority rejected it, and whole groups of providers turned out to be missing.
DORA readiness
DORA requirements, checked against how your company actually runs
We work out which parts of DORA apply to you, compare what you do day to day with what it requires, and give you the gaps and a plan to close them. If you want, we close them with you, and keep the result current afterwards.
- ICT risk management
- Third-party register
- Incident reporting
Financial companies, and the IT suppliers they rely on
- Applies to
- Financial companies: banks, payment and e-money institutions, investment firms, crypto-asset service providers, insurers and others. Their IT suppliers meet it through contracts
- What it asks for
- ICT risk management, incident reporting, resilience testing, and a register of ICT third-party contracts
- In force
- Since 17 January 2025
- Who checks
- Financial supervisors
DORA does not issue a certificate the way ISO 27001 does. What a supervisor looks at is the evidence behind each requirement.
Which parts apply, then what is missing
Scope
Which entities and ICT services are covered, and what is already in place.
Gap assessment
Policies, contracts and the register compared with evidence of how things run, through interviews and records.
Plan
Gaps ordered by deadline and effort, with an owner for each, ready to submit to a supervisor if one is asking.
Closing the gaps
Your team closes them, or we work alongside, or we take them on: the register rebuilt, incident classification aligned, contracts prioritised for renegotiation.
Keeping it current
The register updated when contracts change, annual submissions supported, and periodic check-ins before the next review.
A rejected register, and a framework that existed on paper
ResultThe rebuilt register passed validation on the next submission.A payment institution whose register was rejectedRead the engagement
It had been assembled in a rush from procurement spreadsheets, and missed whole categories of providers, including the sub-processors behind the card processor. We rebuilt it with procurement, legal and IT, mapping each ICT service to the business function it supports and tracing subcontracting chains. We also found contracts without the clauses DORA requires and no exit plans for critical providers. The next submission passed validation, and the register is now updated whenever a new ICT contract is signed.
ResultWithin six months, the policies were backed by working processes and evidence.An asset manager whose framework existed on paperRead the engagement
A routine supervisory review found that the firm's ICT risk management framework existed mostly on paper, and a remediation plan with deadlines was due. We compared what the policies said with what was happening, through interviews with IT, operations and compliance and through evidence such as access reviews, backup tests and incident logs. Backups had never been restore-tested, incident classification did not match DORA's reporting thresholds, the management body had never formally reviewed ICT risk, and about a third of the SaaS tools in use were missing from the register. The firm submitted a remediation plan built on our roadmap, with owners and deadlines. Quarterly check-ins now keep it ready for the next review.