DORA / NIS2 readiness and evidence pack
Scope and price are agreed in writing before work starts.
Need to show how your organisation meets DORA or NIS2 requirements? For one legal entity and one regulation, we assess gaps, review the agreed supplier and ICT contracts and organise the specified evidence for management and auditors. Includes a short executive fraud briefing. Implementing controls is quoted separately.
When you need this service
- A review by the authority, an audit or a customer check is coming.
- You have policies but are not sure you can prove what works.
- You need a plan with owners and deadlines for management to approve.
The benefit for your organisation
- Management gets clear priorities to direct budget and effort at the gaps found.
- You go into the review with organised evidence, not a folder of policies.
- You know what is ready, what is missing and who owns the next step.
For whom
One legal entity that must show DORA or NIS2 evidence to a supervisor, bank, customer or auditor.
Typical trigger: A supervisory letter, a customer’s due-diligence request, an audit finding, or a management decision to close known gaps.
What you receive
- Gap assessment and prioritised roadmap
- Review of supplier and ICT contracts against the regulation
- Presentation of findings for management and auditors
One control, several regulations
We link every requirement to the control that meets it and to the evidence that the control works. When one control covers DORA, NIS2 and ISO 27001, the work is not repeated.
Starting price
from €7 900
The price covers the stated base scope. Additional work is agreed in advance.
Timeline and your input
3–5 weeks (DORA: 3–6)
A contact who can provide policies, contracts and access to the people who own the controls; time from those owners. Typical timeline 3–5 weeks once inputs are available; the DORA track takes 3–6 weeks.
What the price includes
- 1 legal entity
- 1 regulation (DORA or NIS2)
- Up to 100 employees
- Up to 15 supplier or ICT contracts reviewed
- Up to 25 existing policies assessed
Agreed separately: Implementing controls and remediation; a second regulation or a second entity (see extras); ongoing maintenance of the evidence.
Detailed terms
Base-scope price. The exact price is fixed in writing before work starts. It changes only when the agreed number of entities, systems, domains, contracts, documents, interviews, languages or depth of review falls outside the base scope. No additional work is charged without prior agreement.
- +€250 per additional supplier contract
- +€1 900 per additional legal entity in the same group
- 101–500 employees, or two regulations at once: from €13 900
Contract review and processing an ICT arrangement in the register are separate activities. If both are required beyond the included limits, the quotation lists each additional fee separately.
A larger scope is one quotation, not stacked add-ons. The extra for a second entity applies to shared systems, policies and governance — a genuinely separate environment is quoted individually. Limits do not multiply automatically; the from €13 900 figure is the starting price for the expanded project as a whole; its scope is described in one quotation.
What you prepare after we agree scope: available policies, a contract list and a responsible owner. A brief description is enough for the first conversation. Do not send passwords or health information through the form. Documents and technical information needed for the agreed work are exchanged through a secure channel arranged in advance.
We prepare the agreed materials and document the scope, findings and limitations. Decisions by regulators, auditors or clients remain theirs to make.
Sample output
Demonstration example — not a real client.
| Requirement | Status | Evidence | Gap | Action |
|---|---|---|---|---|
| Management approves the measures | partial | Minutes from May 2026 | The plan is not approved | Management decision |
| Incident reporting | missing | — | No procedure | Procedure and templates |
| Backups | in place | Restore-test record, June 2026 | — | Annual test |
A policy and a record of its execution answer different questions. The control evidence guide shows how to connect a requirement to an owner and a verifiable result.