Français
Nederlands
DeutschDORA compliance
Since 17 January 2025, the DORA regulation has required financial entities to manage their ICT risks, report major incidents and oversee their ICT providers. We help you measure the gaps and close them, drawing on our founder's more than 25 years of security governance experience, including in finance.
Who it is for
- Banks, insurance and reinsurance undertakings, investment firms and management companies.
- Payment and e-money institutions, crypto-asset service providers.
- Smaller entities, for which DORA provides proportionate requirements.
- IT providers to financial clients, which impose DORA's contractual requirements on them.
What we do
Gap analysis
Assessment of your ICT risk management framework against DORA and its technical standards, in proportion to your size and risk profile.
Register of information
Inventory of your contractual arrangements with ICT providers, kept up to date and ready for the annual submission to the supervisor (NBB or FSMA).
Major incidents
Procedures for classification under DORA's criteria and for reporting on time, backed by digital forensics.
ICT third-party providers
Pre-contract risk assessment, mandatory contractual clauses, monitoring and exit strategies.
Resilience testing
A proportionate testing programme: vulnerability assessments, penetration tests, configuration reviews and crisis exercises.
Management training
The management body bears ultimate responsibility for ICT risk and must keep its knowledge up to date: we train its members as well as staff.
Our approach
DORA calls for evidence, not just policies. Every measure is documented so that it can be shown to the supervisor or an auditor.
Qualification
Your status under DORA, the competent authority and any relief linked to your size.
Gap analysis
Review of policies, procedures, register and contracts, based on the evidence available.
Action plan
Measures prioritised by risk and effort, approved by the management body.
Implementation and evidence
Policies, register and procedures drafted or updated with your teams, then tested in an exercise.
Frequently asked questions
DORA or NIS2: which one applies?
For a financial entity subject to DORA, DORA's rules on ICT risk management and incident reporting apply instead of the equivalent NIS2 provisions. A non-financial IT provider falls under NIS2 if it meets its criteria.
We are a bank's IT provider: does DORA concern us?
Indirectly. Your clients must include the clauses required by DORA in their contracts, assess their providers and be able to audit them: expect questionnaires and requests for evidence. Only providers designated as critical by the European authorities are supervised directly.
What is the register of information?
It is the register of all contractual arrangements for ICT services with third-party providers, in the format defined by the European Supervisory Authorities. It must be kept up to date and submitted to the competent authority every year.
Is threat-led penetration testing (TLPT) mandatory?
Only for entities designated by the competent authority, usually the largest. All entities, however, need a proportionate testing programme: vulnerability assessments, penetration tests, reviews and exercises.
Does DORA apply to small entities?
Yes, proportionately. Some entities, such as small and non-interconnected investment firms, may apply a simplified ICT risk management framework, and microenterprises benefit from lighter requirements.