Digital Operational Resilience Act (DORA)

The requirements spanning DORA’s five pillars are vast. We can deploy our experts into your company to conduct a scoping exercise and gap assessment that will provide a robust platform to progress from.

To begin, we provide a risk-based prioritisation and scoping exercise on the application of proportionality. We’ll then review existing policies, controls and frameworks and map them to DORA requirements.

Following the gap assessment, our experts can design a remediation plan that includes tactical actions with owners, activities and timeframes.

By collaborating with cross-functional stakeholders and putting effective roles and responsibilities in place, our team will implement agreed upon remediation actions in a timeline that works best for your organisation’s needs.

Following the agreed-upon remediation plan, our team will execute an appropriate governance structure and delivery-focused model, that aligns with the five pillars of DORA:

• ICT risk management framework,
• ICT-related incident management, classification and reporting,
• Digital operational resilience testing, 
• ICT third-party risk management, and
• Information sharing.

For a large-scale regulatory initiative such as DORA, obtaining practical assurance support and guidance in advance of the implementation guideline offers an immediate ‘value add’ to your newly implemented operating model.

We have a range of SMEs available to conduct assurance reviews and quality checks. They have skills, knowledge and experience of gap assessments and market trends, and can support your company’s DORA readiness efforts.

Our SMEs provide training, tools and templates that deliver immediate results. Working closely with your team, they leverage a flexible, best-in-class suite of toolkits designed to meet your specific needs, manage your implementation programme, and enhance the delivery of DORA requirements– all of which ensures a strong level of compliance.

DORA introduces an increased rigour on the expectations around threat-led penetration testing (TLPT) that goes above and beyond TIBER (as a relatable example).

To meet the requirements laid out in DORA Articles 26 and 27, our cyber experts will manage an end-to-end TLPT programme, guaranteeing completion of the advanced testing requirements, which are mandated from 2025 onwards.