DORA
Digital resilience in the financial sector, DORA-compliant and ready for scrutiny
We take financial entities and their IT providers through ICT risk management, reporting duties and resilience testing — from the bank to the fintech scale-up.
Find out in 20 minutes whether you are affectedHow we work together
No obligation, no sales pressure
DORA · Digital Operational Resilience Act
Art. 30 DORAICT register
The reality
DORA makes IT outages a board responsibility: management has to approve and monitor the ICT risk framework, and is liable if resilience, reporting lines or provider contracts are not in order.
The risk of waiting
In force since 17 January 2025, directly applicable across the EU with no transition period — and for ICT providers in the supply chain too (Art. 30 DORA).
The advantage of acting
Solid DORA evidence strengthens the confidence of supervisors, banks and end customers, and is increasingly expected in tenders from insurers and major banks.
Which companies does DORA apply to?
Financial entities
Banks, payment and e-money institutions, investment firms, insurers and crypto-asset service providers have had to implement DORA since January 2025, regardless of their size.
ICT service providers to financial entities
Software, cloud and data-centre providers are indirectly affected through the contractual requirements of Art. 30 DORA.
What you get
- ICT risk frameworkA documented framework for your ICT risk management that management can approve and monitor.
- Register of ICT providersA complete overview of your ICT third-party providers, as DORA requires.
- Contract review (Art. 30)Your provider contracts reviewed against the minimum content required by Art. 30 DORA.
- Incident reportingClear procedures for classifying major ICT incidents and reporting them within the deadlines.
- Resilience and threat-led testing (TLPT)Planning and support for the testing of your digital operational resilience that the law requires.
- Governance & board trainingManagement knows its responsibility under DORA and can demonstrably exercise it.
Threat-led testing & monitoring
IT security from our own team.
We often see a solid level of IT security but an incomplete register of ICT service providers. Contracts with smaller software and cloud providers in particular rarely contain all of the minimum content required by Art. 30 DORA.
How we work together
Applicability & gap analysis
Does DORA apply to you? A comparison against the five areas of requirements.
ICT risk framework & providers
Set up risk management, the register and the contracts for ICT third parties.
Reporting lines & resilience testing
Establish incident reporting and testing / TLPT procedures.
Do you work with financial entities?
We will work out with you how far DORA is relevant to you.
- No obligation
- No sales pressure
Frequently asked questions
Which companies fall under DORA?
DORA covers some 20 categories of financial entity, among them banks, payment institutions, e-money institutions, investment firms, insurers, reinsurers, crypto service providers and rating agencies — regardless of size, though with lighter requirements for smaller players. DORA also covers critical ICT third-party providers such as cloud operators, which European supervisors can oversee directly. The regulation rests on five pillars: ICT risk management, reporting ICT incidents, testing digital operational resilience (including threat-led penetration testing, TLPT), managing third-party risk, and information sharing between financial entities. DORA has applied directly in every EU member state since 17 January 2025, with no national transposition period.
Does this affect us as a small fintech?
Yes. DORA applies to the financial sector and its ICT providers regardless of size, with somewhat lighter requirements for smaller players.
Is it enough that our cloud provider is DORA-compliant?
No. Responsibility for the ICT risk framework and for the contracts (Art. 30) stays with you as the financial entity.
Let's talk about your project.
Tell us what you have in mind. Your message goes straight to our team.
Daniel Tölgyesi
CEO
Loading the form …