DORA compliance assessment
The Digital Operational Resilience Act has applied since 17 January 2025 to banks, insurers, investment firms, payment institutions and other EU financial entities. Unlike NIS2 it is a regulation, so it applies directly and the same way across the EU. We assess where you stand on each of its pillars.
Who it is for
- EU financial entities within DORA’s scope.
- ICT providers to financial entities, now facing DORA clauses in their contracts.
- Groups that need one view of DORA, NIS2 and ISO 27001 together.
What we assess
- ICT risk management framework and governance.
- ICT-related incident classification and reporting.
- Digital operational resilience testing, including whether threat-led penetration testing applies to you.
- ICT third-party risk: contracts, exit plans and the register of information.
- Information-sharing arrangements.
What you receive
- A DORA gap register by pillar.
- A review of your register of information and your critical ICT contracts.
- A remediation plan with a price range on every item.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically three to five weeks for one financial entity.
Common questions
We are an ICT provider, not a bank. Does DORA affect us?
Yes, through your contracts: financial entities must include specific provisions in agreements with ICT providers. Providers designated as critical are also overseen directly by the European supervisory authorities.
How does DORA relate to NIS2?
For financial entities in its scope, DORA is the specific law and takes precedence on ICT risk management and incident reporting. We assess both at once where you are subject to both. See NIS2 assessment.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
DORA assessment
We reply within one business day.
Nothing you send is shared outside Calibre.