DORA Compliance for EMIs, PIs and CASPs

DORA requires a structured ICT risk management framework that shows accountability and proportionality. We design and document it: risk registers that categorise ICT threats, control mappings that link risks to mitigation, and escalation procedures so incidents are reported and handled in time.

Governance is aligned so ICT risks are part of management oversight and board reporting, and you can show that risks are actively monitored, proportionately mitigated and regularly reviewed.

You must be able to detect, escalate and recover from ICT disruption within defined timeframes. Two key measures are the Recovery Time Objective (RTO), the maximum time a service may be unavailable, and the Recovery Point Objective (RPO), the maximum tolerable data loss measured in time.

We design incident playbooks, escalation workflows and BCP/DR arrangements covering internal processes and third-party dependencies, run business impact assessments, set measurable recovery objectives and organise exercises that test the plans in practice.

DORA puts strong emphasis on ICT providers and outsourcing: a register of providers, due diligence and ongoing assessment, and contracts with audit rights, continuity obligations and exit strategies.

We set up oversight that classifies providers by risk, assesses their continuity arrangements and documents exit plans. Where required, we coordinate digital operational resilience testing, including threat-led penetration testing (TLPT) for entities in scope, and prepare the evidence.

An effective framework needs a maintained and consistent set of policies, procedures and evidence logs covering ICT risk management, incident response, third-party oversight and testing, each mapped to the regulation.

We prepare and adapt the full set, referencing the relevant DORA articles and fitting it into your governance, so staff have clear guidance and audits find fewer ambiguities.

You must detect ICT incidents, escalate them internally, notify the authority when thresholds are met and keep verifiable records of incidents and remediation.

We implement procedures aligned with DORA's incident classification and notification standards: escalation protocols, incident registers and templates for the initial, intermediate and final reports, plus logs of remediation and test results. For ongoing filing, see Regulatory reporting.

Staff, management and the board must understand their roles in ICT risk management. Regulators expect structured training, attendance logs and awareness activities.

We run sessions for senior management, compliance teams and operational staff on ICT risk, incident response, third-party oversight and reporting, tailored to your business model and kept up to date as the rules evolve.

DORA is a continuous obligation. Frameworks, continuity arrangements and provider oversight must stay current as systems, providers and threats change.

We set up monitoring routines and review schedules: policy reviews, periodic continuity and recovery tests, provider re-assessments and risk register updates, with evidence logs for every review and remediation step. For an outsourced ICT/DORA role, see Compliance officer outsourcing; for an independent check, see Audits & assessments.