DORA Readiness Assessment

Assess your organisation against all 5 DORA pillars and 31 regulatory areas — and close every gap before regulatory deadlines.

We work alongside your team to achieve full DORA compliance, covering ICT risk management, incident response, resilience testing, and third-party risk.

request a quote

When is a DORA assessment critical?

DORA is already in force

The Digital Operational Resilience Act is mandatory for financial entities and ICT providers. Non-compliance may result in regulatory penalties, fines, and operational restrictions.

If you are a financial entity or ICT provider

DORA applies to banks, fintechs, payment providers, investment firms, and critical ICT service providers supporting them.

If you rely on third-party providers

DORA introduces strict requirements for vendor risk management, contracts, and oversight.

What we assess

We assess your organisation against DORA requirements, with clear ratings and actionable remediation:

1. ICT Risk Management

Governance, risk framework, asset management, access control, encryption, change management, BCP/DR, continuous improvement

2. Incident Management

Detection, classification, response procedures, regulatory reporting, root cause analysis, evidence handling

3. Digital Operational Resilience Testing

Core testing capabilities (as defined by DORA Article 25):

Vulnerability assessments and automated scanning
Network security assessments
Gap analysis and control validation
Source code review (where applicable)
Open-source intelligence and exposure analysis
Scenario-based testing (including incident simulations)
End-to-end and integration testing
Compatibility and performance testing
Penetration testing

4. Third-Party Risk Management

Vendor register, due diligence, contract compliance, concentration risk, exit strategies, ongoing monitoring

5. Information Sharing

Threat intelligence, indicators of compromise (IoCs), regulatory communication, collaboration frameworks

Our approach: from gap analysis to full compliance

1. Assessment & Gap Analysis

We assess all 31 areas through document review and stakeholder interviews, identifying gaps and control weaknesses.

2. Resilience Testing Programme

We conduct the full range of testing activities required under DORA, based on your risk profile, including:

Vulnerability assessments
Penetration testing
Scenario-based resilience testing
Support for TLPT engagements (where required)

3. Recheck & Final Compliance Report

We verify remediation and deliver a final report suitable for regulatory review and stakeholder validation.

We don't just assess — we help you reach compliance.

FAQ

Do we need a DORA assessment if we already have ISO 27001?

Yes. ISO 27001 provides a foundation, but Digital Operational Resilience Act introduces additional regulatory requirements, especially around incident reporting, resilience testing, and third-party risk.

Is DORA only about cybersecurity?

No. DORA focuses on operational resilience, combining security, risk management, incident response, and business continuity.

Can non-EU companies be subject to DORA?

Yes. If you provide ICT services to EU financial entities, DORA requirements may apply to you indirectly through contractual and regulatory obligations.

Will we receive documentation suitable for regulators?

Yes. All deliverables are designed to serve as evidence for regulators, auditors, and partners.