Who we help
ICT and managed service providers
Your customers are regulated, so their requirements now reach you: contract clauses, security questionnaires, audit rights and evidence. We help you answer them once, properly, and reuse the work.
The benefit: prepared answers and evidence help you move through the customer’s approval process and reuse the work in later reviews.
Scope and price are confirmed in writing before work starts.
Discuss your caseIs this you?
- You provide IT, cloud, hosting, software, data or managed services to banks, insurers, investment firms, payment or crypto-asset service providers.
- You are a managed service provider (MSP) or managed security service provider (MSSP) — a sector NIS2 (EU cybersecurity directive) itself names.
- Your customers in energy, health, transport or manufacturing ask you for evidence because NIS2 makes them responsible for supply-chain security.
What your customers will ask for
DORA contract clauses
Financial entities must put specific terms in ICT (information and communication technology) contracts: service descriptions, data locations, incident assistance, cooperation with authorities, termination rights, and for critical functions service levels, audit and access rights and exit plans (DORA Art. 30).
The register of information
Your services, locations and subcontractors end up in your customer’s DORA register of information (Art. 28). Errors there come back to you as questions.
Security questionnaires and evidence
Questionnaires, audit requests and requests for policies, test results and certificates. A policy alone rarely satisfies them; records of operation do.
NIS2 supply-chain requirements
NIS2 requires covered entities to manage the security of their suppliers (Art. 21(2)(d)). As an MSP or MSSP of medium size or larger you may be covered directly.
Bank supplier pack — €3 900
You move through the bank’s approval with prepared answers and evidence that you reuse with the next financial customers.
For one company and one financial customer: a review of the ICT contract against the DORA Art. 30 clauses and what is reasonable to accept; draft answers to the customer’s security questionnaire; an evidence index you reuse with the next customers; a gap list with owners.
Included: one financial customer; up to 2 contracts (the main contract and one annex or agreement); one questionnaire of up to 150 questions; up to 2 rounds of clarification with the customer. From you: the contracts, existing policies and available evidence, and one technical contact. Out of scope (quoted separately): further customers or contracts, more questionnaires or portals, legal representation and implementing missing measures.
Usually 2–3 weeks. Not a legal opinion — legal review of the contract is commissioned separately from a lawyer. Implementing missing measures is agreed separately. Scope is confirmed in writing before work starts.
Only a questionnaire, without contract clauses? The questionnaire service is enough — from €1 300.
How we help
| Step | What you receive | Price |
|---|---|---|
| Bank supplier pack | DORA contract-clause review, draft questionnaire answers and a reusable evidence index — fixed price | €3 900 |
| Answer a questionnaire | Draft answers, organised evidence and a list of what is missing | from €1 300 |
| Review DORA clauses | What is reasonable to accept, what to negotiate, what you must be able to evidence | by quotation |
| Assessment and evidence pack | One regulation, gaps marked, evidence organised and reusable for the next customer | from €7 900 |
| External expert roles | A named specialist who keeps answers, evidence and registers current | from €1 400 / month |
| Annual compliance programme | The assessment plus 12 months of an external expert role in one contract | €24 700 |
Read more
- Cyber Resilience Act (CRA) readiness
- ISO 27001 certification readiness
- Becoming a supplier to a bank
- Security questionnaires
- DORA register of information
- DORA or NIS2 — which applies
Boundaries
- We are not a certification body and do not issue legal opinions; legal questions are commissioned separately from a lawyer.
- We do not act as a statutory EU representative (under GDPR, NIS2 or the AI Act) — that is a separate legal role.
- Responsibility for decisions and reporting stays with the organisation’s management.