Digital operational resilience
The digital operational resilience regulation for finance. We cover ICT risk management, incidents, TLPT and third parties.
Regulation (EU) 2022/2554
- What is at stake
- TLPT testing and ICT third-party risk
Who it applies to
- Banks, insurers and asset managers
- Payment and e-money institutions
- Critical ICT providers to finance
Typical timeline
6 to 9 months
Regulation (EU) 2022/2554
In detail
Digital operational resilience for the whole financial sector.
Regulation (EU) 2022/2554, DORA, has applied since 17 January 2025 to more than 20 types of financial entity: banks, insurers, payment and e-money institutions, asset managers, investment firms, crypto-asset providers and more.
It is built on five pillars: ICT risk management, incident management and reporting, digital operational resilience testing, ICT third-party risk management and threat information sharing.
For the first time, critical ICT providers to the sector (large cloud providers, for example) also fall under direct supervision by European authorities.
Real scenarios
Where compliance is hardest.
The supplier register
Every ICT contract, the function it supports and its criticality must be documented in a standard format submitted to the supervisor.
Incident classification
The criteria for deciding whether an incident is major are detailed, and reporting deadlines start from classification.
Contract clauses
ICT supplier contracts must include minimum clauses: audit rights, data location, exit plans and more.
What you get
What you will have at the end.
- ICT risk management framework
- Register of information in the official format
- Incident classification and reporting policy
- Resilience testing programme
- Review of ICT supplier contracts
- Exit strategies for critical functions
How we engage
Three ways to approach it.
Gap analysis
Know exactly what is missing.
- 2 to 3 weeks
- Prioritised report
- Fixed quote
- Most chosen
Full implementation
We take you to the audit.
- Policies and controls
- Evidence prepared
- Audit support
Maintenance
Stay compliant year after year.
- Annual internal audit
- Change tracking
- Support with the auditor
DORA
What we focus on
- 01
ICT risk management framework
- 02
Incident classification and reporting
- 03
Resilience testing and TLPT
- 04
ICT third-party register and contracts
Digital operational resilience
How we work
- 1
Diagnosis
Gap analysis against the framework, prioritised by risk.
- 2
Plan
A roadmap with owners, budget and schedule.
- 3
Implementation
Policies, technical controls and evidence, with your team.
- 4
Audit
Internal pre-audit and support in front of the auditor.
FAQ
Frequently asked questions
How much does preparing for Digital operational resilience cost?
It depends on scope and starting point. After the first call we give you a fixed quote, no surprises.
Can I combine it with other frameworks?
Yes. We reuse shared controls so each additional certification costs far less.
Does DORA affect technology providers?
Indirectly all of them, as financial customers will require clauses and controls. Directly, those designated as critical by European authorities.
What are the reporting deadlines?
Initial notification within 4 hours of classifying as major (max 24 hours from detection), intermediate report within 72 hours and final within one month.
Services
Next step
Shall we talk about your case?
30 minutes with a partner, not a salesperson. No commitment.