Resilience, regulated.
DORA is an EU regulation, directly applicable in every member state, that requires financial entities to withstand, respond to and recover from ICT disruption — and to manage the risk created by their technology providers.
You may not be a regulated EU entity yourself, but if you sell software, cloud, data or managed services to one, your customer must assess you, put specific clauses in your contract, record you in its register of information, and monitor you over time. Being ready for that scrutiny is now a condition of winning and keeping EU financial-services business.
What DORA asks for.
ICT risk management
Governance, a documented ICT risk framework, protection, detection, response and recovery.
Incident management & reporting
Classifying ICT-related incidents and reporting major ones to regulators on strict timelines.
Resilience testing
A risk-based testing programme, including threat-led penetration testing for significant entities.
ICT third-party risk
Due diligence, contract provisions, register of information, concentration risk and exit strategies.
Information sharing
Voluntary exchange of cyber threat intelligence within trusted communities.
Four steps, one accountable team.
Engage any single stage or the whole journey. Every engagement reuses the controls and evidence you already have, and runs on Verigo Assure so compliance stays current after we finish.
DORA gap assessment
Map your existing ISO 27001 / SOC 2 controls to the DORA requirements your EU customers will test.
Contract & due-diligence readiness
Prepare for Article 30 clauses, security questionnaires and audit-right requests before they arrive.
Incident & resilience processes
Incident classification and customer-notification procedures, plus a resilience testing plan that supports your customers.
Ongoing assurance
Keep evidence current for annual customer reviews — on Verigo Assure, alongside your other frameworks.
From scoping to ongoing assurance.
Indicative phases and durations. Your plan is scoped to your services, existing controls and deadlines.
Keep DORA evidence current, not just audit-ready once.
Our compliance platform keeps controls, evidence and owners in one place and flags gaps before they become findings. Included with Verigo consulting engagements.
Good to know before we start.
Questions about scope, timelines or how DORA fits with your existing frameworks? A senior practitioner will walk you through it.
DORA directly regulates EU financial entities. US companies are affected when they provide ICT services to those entities: your customers must apply DORA requirements to you through due diligence and contract terms, and a small number of providers may be designated as critical ICT third-party providers subject to direct EU oversight.
Selling into EU financial services?
Tell us which EU customers and services are in scope. We will map your current controls to DORA and show you the fastest route to customer-ready evidence.