Who we help
Financial organisations
Financial organisations in scope — banks, payment and e-money institutions, investment firms, insurers, crypto-asset service providers and other financial entities — must show how they manage technology risk under DORA. We help you see where you stand, organise the evidence and keep it current.
The benefit: you are prepared for supervision and audit, management has clear decisions, and evidence and fixes are kept current and tracked.
Scope and price are confirmed in writing before work starts.
Discuss your caseIs this you?
- A credit institution, payment or e-money institution, investment firm, insurer or reinsurer, insurance intermediary, crypto-asset service provider, fund manager, crowdfunding provider or another entity listed in DORA (EU Digital Operational Resilience Act) Art. 2.
- Your supervisor, auditor or management body asks how you manage ICT (information and communication technology) risk, incidents, testing and suppliers.
- Some smaller entities apply a simplified ICT risk framework (DORA Art. 16) — we confirm which regime applies to you.
Scope exemptions apply: for example, insurance intermediaries that are micro, small or medium-sized enterprises are excluded (DORA Art. 2(3)). We confirm whether DORA applies to your organisation.
What DORA asks of you
ICT risk framework
Governance, policies and controls for technology risk, approved and overseen by the management body, which remains responsible (Art. 5–16).
Incident reporting
Major ICT-related incidents are classified and reported to the competent authority on strict deadlines — the initial notification is due within hours (Art. 17–23).
Resilience testing
A testing programme for critical systems, and threat-led penetration testing every three years for designated entities (Art. 24–27).
ICT third parties
A register of information on all ICT arrangements and specific contract clauses with providers (Art. 28–30).
How we help
| Step | What you receive | Price |
|---|---|---|
| DORA readiness and evidence pack | Gaps, the register of information (up to 20 ICT arrangements) and ordered evidence with an action plan | from €7 900 |
| DORA register diagnostic | A check of the register before submission or after rejected errors | €2 600 |
| Delivering the DORA plan | From the assessment to implemented measures and documented evidence | from €9 900 |
| External expert roles | For example support to the ICT risk control function, with a clear monthly capacity | from €1 400 / month |
| Annual compliance programme | The assessment plus 12 months of an external expert role in one contract | €24 700 |
Assessment and delivering the plan for the base scope: from €17 800 (delivery does not include the assessment). The annual programme is a different option: the assessment plus 12 months of an expert role for €24 700; technical implementation is not included in it.
Read more
- DORA readiness and evidence pack
- Supplier and third-party risk management
- DORA register of information
- Threat-led penetration testing under DORA
- DORA or NIS2 — which applies
Boundaries
- We are not a certification body and do not issue legal opinions; legal questions are commissioned separately from a lawyer.
- We do not act as a statutory EU representative (under GDPR, NIS2 or the AI Act) — that is a separate legal role.
- Responsibility for decisions and reporting stays with the organisation’s management.
- We do not promise full compliance or a positive supervisory outcome — we help you show what has been done and what remains.
For the register structure and evidence, start with what the DORA register contains. A supplier responding to your request can use the guide for suppliers to financial entities.