The EU regulation on digital operational resilience for the financial sector.
Practical DORA compliance consulting for financial organisations to meet regulatory obligations and improve operational resilience.
We bring your organisation into DORA compliance by combining our specialist advisory practice with your unique operational context and business goals.
Over two decades of consulting experience with major banks, insurers, stock exchanges and other financial market infrastructure across multiple EU jurisdictions.
Support for DORA compliance programme design and implementation. Plus, we can also provide testing, including Threat-Led Penetration Testing (TLPT).
Our compliance specialists work alongside penetration testers and red teamers to build DORA programmes that satisfy regulators and survive real attacks.
We translate DORA into controls and processes that suit your organisation, so that you can meet regulatory expectations without unnecessary operational overhead.
Recommendations are based only on what your organisation needs.
Get the security foundations to support operational resilience long after compliance is achieved.
Financial entities operating within the EU need to comply with DORA. This includes banks, insurers, investment firms, payment institutions, electronic money institutions, and crypto-asset service providers,
DORA also establishes requirements around the ICT third-party providers that support financial entities, with certain providers designated as critical subject to direct regulatory oversight.
UK-headquartered firms with EU-regulated subsidiaries or branches fall within scope for those entities.
DORA requires financial entities to be able to withstand, respond to and recover from ICT-related disruption.
Its requirements are organised around five core areas:
Testing is a central part of DORA, both annual and threat-led security testing.
Financial entities other than microenterprises must establish a risk-based testing programme and ensure, at least yearly, that appropriate tests are carried out on all ICT systems and applications supporting critical or important functions, to identify weaknesses, deficiencies and gaps in resilience.
Certain financial entities identified by competent authorities must also conduct advanced testing through Threat-Led Penetration Testing (TLPT) at least every three years. TLPT simulates the tactics, techniques and procedures of real-world attackers against live production systems supporting critical or important functions.
SECFORCE covers both DORA requirements. Our compliance team designs the governance and assurance frameworks, and our red team and penetration testing teams run the testing, so you do not need a separate provider.
DORA applicability assessments.
ICT risk management framework development.
Third-party assurance programme design.
Operational resilience governance implementation.
Regulatory reporting process development.
TLPT programme design and execution.
Audit and regulatory readiness reviews.
We assess your existing controls and processes against DORA to establish where you comply and where the gaps are.
Then comes the plan. It addresses and prioritises your gaps based on your organisation’s risk profile, critical functions, existing technology and resources.
We then help you implement the plan, i.e., the governance, processes and controls needed to meet DORA requirements.
We assess your readiness against DORA requirements and help resolve any outstanding issues before regulatory scrutiny.
| Framework | Type | Certificate | Jurisdiction | Overlap |
|---|---|---|---|---|
| DORA | Legal obligation | EU financial entities | NIS2, ISO 27001 | |
| ISO 27001 | Voluntary certification | Universal | SOC 2, GDPR, NIS2, DORA |
|
| NIS2 | Legal obligation | EU member states | DORA, CS&R Bill | |
| CS&R Bill | Legal obligation | UK | NIS2 |
Should your organisation need to comply with more than one regulatory testing framework at the same time, alongside DORA, we also offer services under ISO 27001, NIS2 and Cyber Security and Resilience Act.
Thank you!
Please try again later.
