Services

DORA — the readiness and evidence pack for financial entities

Scope and price are agreed in writing before work starts.

For financial entities in any EU Member State, supervised by the national competent authority under their licence (in Bulgaria, for example, the BNB or the FSC), and for the ICT providers they depend on. The readiness and evidence pack applied to DORA: assessment of the ICT-risk framework, the register of information and the agreed evidence.

from €7 9003–6 weeks

from €9 900implementation of the roadmap (assessment not included)

When you need this service

You are a financial entity and the supervisor will ask for DORA (EU Digital Operational Resilience Act) evidence.
The register of information or supplier contracts are not in order.
You know the gaps but need someone to deliver the plan.

The benefit for your organisation

Management sees where the entity stands against DORA and what to decide first.
The register of information and the evidence are organised for the supervisor.
Implementation starts from the real gaps, not a generic list.

A Dyasol certificate is included after a successful assessment once the work is done. The assessment is carried out by a specialist who was not involved in the work. Regulatory assessment and certificate

In plain language: If you are a financial entity, DORA requires you to show how you manage technology risk, incidents, testing and important suppliers. Some ICT (information and communication technology) providers are affected through their financial-sector customers. We identify the documents, records and technical measures your specific organisation needs.

For whom

One financial entity in any EU Member State, supervised by the national competent authority under its licence (in Bulgaria, for example, the BNB or the FSC) — and, indirectly, the ICT providers it depends on.

Typical trigger: A supervisory request, a register submission, a new ICT contract, or the management body asking where the entity stands.

What you receive

Gap assessment and prioritised roadmap
Review of supplier and ICT contracts against the regulation
Presentation of findings for management and auditors

One control, several regulations

We link every requirement to the control that meets it and to the evidence that the control works. When one control covers DORA, NIS2 (EU cybersecurity directive) and ISO 27001, the work is not repeated.

View a sample deliverable → (illustration of the structure, not a full DORA register)

Starting price

from €7 900

The price covers the stated base scope. Additional work is agreed in advance.

Timeline and your input

3–6 weeks

The ICT contract list, existing policies, the register of information if one exists, and time from the ICT-risk owner. Typical timeline 3–6 weeks.

What the price includes

1 legal entity
1 regulation — DORA
Up to 100 employees
Up to 15 supplier or ICT contracts reviewed
Up to 25 existing policies assessed
Register of Information covering up to 20 ICT arrangements
1 supervisory authority (the national competent authority under your licence)

Agreed separately: Implementation of the roadmap (from the published figure; it does not include the assessment); resilience testing; ongoing control-function work. Delivering the DORA plan is a separate project — from €9 900.

Discuss your case Related questions

Detailed terms

The included 20 arrangements are a commercial limit, not a definition of a complete register. For 40 arrangements, the published increment for the additional 20 is 20 × €200 = €4 000, before other scope changes. Contract review and register processing are distinct activities. One quotation shows the full coverage and applicable increments, without charging twice for the same work.

Base-scope price. The exact price is fixed in writing before work starts. It changes only when the agreed number of entities, systems, domains, contracts, documents, interviews, languages or depth of review falls outside the base scope. No additional work is charged without prior agreement. Scope and prices.

Need both stages? Assessment €7 900 plus implementation from €9 900 — a combined starting budget of €17 800. The starting price does not cover an unlimited number of corrections; a suitable prior assessment is reviewed before a new engagement.

+€250 per additional supplier contract
+€1 900 per additional legal entity in the same group
101–500 employees, or two regulations at once: from €13 900
+€200 per additional ICT arrangement in the register
Implementation of the roadmap: from €9 900 — after the assessment; the assessment is not included

A larger scope is one quotation, not stacked add-ons. The extra for a second entity applies to shared systems, policies and governance — a genuinely separate environment is quoted individually. Limits do not multiply automatically; the from €13 900 figure is the starting price for the expanded project as a whole; its scope is described in one quotation.

One product for DORA and NIS2: the readiness and evidence pack covers one regulation for one entity of up to 100 employees, including up to 15 contracts and 25 policies, and documents the evidence agreed in the statement of work. Applied to DORA it also covers the register of information (up to 20 ICT arrangements) and one supervisory authority — see the DORA page. Implementing controls is a separate project and does not include the assessment.

After the assessment you receive the agreed findings and next actions. Technical and organisational implementation can be commissioned separately from Dyasol or carried out by your chosen team. Practical improvements →

For small financial organisations: Financial services →

Independence. Where we support your ICT risk control function or perform outsourced compliance-verification tasks, we do not act as your ICT auditor; the financial entity retains the function, oversight and responsibility; where we build your management system, the certification or independent assessment is done by another body. Checking that our own fixes work remains part of accepting the work. We state the arrangement in writing before you engage us.

Sample output

Demonstration example — not a real client.

ICT arrangement	Function	Critical or important	Gap
Core banking system (provider A)	Payments	yes	No documented exit strategy
Cloud archiving (provider B)	Archive	no	—
Service desk (provider C)	Customer support	yes	No audit-right clause

More sample outputs →

EU law first, national law where it applies. EU regulations such as DORA, the AI Act and the GDPR (General Data Protection Regulation) apply directly in every Member State. Directives such as NIS2 are transposed into national law, so scope details, authorities, reporting channels and deadlines depend on the Member State where you are established or operate. Examples on this site often use Bulgarian law; in each engagement we confirm the national law that applies to you and involve local counsel where needed.

If the register is rejected, the worked validation example shows how to trace a broken reference and document the correction. You can commission a register-only validation and correction service; the format, outputs and submission responsibilities are agreed before work starts.