DORA Compliance
The Digital Operational Resilience Act has applied to EU financial entities since 17 January 2025. We help firms and their ICT providers work out what applies to them and close the gaps.
What Is DORA?
DORA is an EU regulation that requires financial firms to be able to resist, respond to, and recover from ICT disruptions.
Operational Resilience
DORA consolidates and strengthens ICT risk requirements across the EU financial sector. Rather than focusing solely on financial stability, DORA ensures that financial institutions and their technology supply chains remain resilient against outages, cyberattacks, and systemic failures.
Extra-Territorial Impact
Even though DORA is an EU regulation, UK and global organisations are directly caught if they provide financial services within the EU, or if they serve EU financial institutions as an ICT third-party service provider.
The Five Pillars of DORA
ICT Risk Management
Establishing comprehensive frameworks, governance controls, and sound risk strategies to detect, prevent, and protect against operational tech risks.
ICT-Related Incident Management
Standardising the classification, tracking, and fast-track mandatory reporting of major ICT incidents to regulatory competent authorities.
Digital Operational Resilience Testing
Conducting regular vulnerability assessments, system testing, and advanced Threat-Led Penetration Testing (TLPT) for critical entities.
Managing ICT Third-Party Risk
Strict oversight of external vendors, multi-vendor dependency monitoring, and contractual requirements for critical ICT service providers.
Information and Intelligence Sharing
Voluntary and trusted arrangements for sharing cyber threat intelligence between financial institutions to heighten collective defenses.
Who Needs to Comply with DORA?
DORA applies across 20 different categories of financial entities and extends directly into critical technology providers.
Credit Institutions
Banks and credit unions operating or chartered within the EU.
Payment & E-Money
Payment institutions, account aggregators, and electronic money issuers.
Investment Firms & Funds
Brokers, asset managers, UCITS management companies, and crypto-asset service providers.
Insurers & Reinsurers
Direct insurance undertakings, reinsurance firms, and insurance intermediaries.
Market Infrastructure
Trading venues, central counterparties (CCPs), and trade repositories.
ICT Third-Party Providers
Cloud providers, SaaS software vendors, data centres, and MSPs serving EU financial clients.
DORA Readiness Assessment
Our DORA readiness assessment gives you a clear view of where you stand across all five pillars — and what to fix first.
What the Assessment Delivers
We measure your current ICT risk practices against the five DORA pillars, giving you a plan to close the gaps ordered by risk — now that DORA already applies.
- Scope Check: Whether DORA applies to you directly, through contracts, or not at all.
- Gap Analysis: Your current ICT risk practices measured against all five pillars.
- Prioritised Roadmap: A plan to close the gaps, ordered by risk, with clear ownership.
Tom S.
Medical Practice
"Improved control over sensitive medical data"
"Practical guidance on access controls and data protection. Helped define structured access policies and introduced tokenisation for patient identifiers used in analytics."
Sarah S.
Retail, Enterprise
"Reliable partner for telecom data protection"
"Quickly understood telecom data complexity; helped classify sensitive datasets and apply protection measures for subscriber, usage, and billing data."
Pauliina H.
Entertainment, Enterprise
"Effective support for securing customer data"
"Identified where sensitive data lived and applied tokenization and anonymization strategies in a complex telecom environment."
Jordan R.
Computer Networking
"Practical approach to safeguarding e commerce"
"Helped protect PII, payment data, and order histories with tokenization and anonymization; advised on GDPR compliance for international operations."
Charmaine S.
Int. Trade & Development
"Systematic Approach Enhances Data Security"
"Methodical approach through discovery, planning, and implementation; implemented Microsoft Purview for a scalable compliance framework."
Kateryna H.
IT and Services
"Practical approach to protecting sensitive Data"
"Structured data discovery and classification combining technical analysis with finance data privacy expertise; strong masking and tokenization policies."
Snow D.
Market Research
"Practical expertise for telecom information"
"Introduced tokenization and controlled access strategies for subscriber data while still supporting analytics and reporting."
Laura H.
Hospital & Health Care
"Valuable expertise in healthcare protection"
"Strong expertise in healthcare data security; introduced anonymization techniques for safely using patient data in research and reporting."
Find out if your business is DORA-affected.
Tell us where you operate, who your ICT providers are, and what EU authorisations you hold. We'll confirm your DORA position and what needs doing first.
Check If Your Business Is DORA-Affected