DORA Compliance
Digital Operational Resilience Act gap assessment and compliance advisory for EU financial entities.
EU Digital Operational Resilience Act (DORA) Compliance
The EU Digital Operational Resilience Act (Regulation (EU) 2022/2554) became applicable on 17 January 2025, imposing binding ICT risk management, incident reporting, resilience testing, and third-party risk management obligations on financial entities operating in or serving the EU. Covered entities include banks, investment firms, payment institutions, insurance undertakings, crypto-asset service providers (CASPs), and their ICT third-party service providers (TTPSPs). DORA introduces the most prescriptive ICT risk framework ever applied to the EU financial sector, with EBA, ESMA, and EIOPA issuing detailed Regulatory Technical Standards (RTS) on every major obligation.
Intelliroot's DORA compliance programme provides a structured gap assessment, compliance roadmap, and implementation advisory for financial entities and ICT TTPSPs subject to DORA. Our CREST-certified team brings hands-on experience with TIBER-EU (the threat-led penetration testing framework underpinning DORA's TLPT requirement) and deep expertise in ICT third-party risk management — the two most technically demanding components of the DORA compliance programme.
Why DORA Demands Immediate Action
DORA Is Already Applicable
DORA became applicable on 17 January 2025. Financial entities that have not completed their DORA gap assessment and commenced remediation are already in a state of non-compliance. Supervisors in key EU jurisdictions are actively reviewing DORA readiness across the financial sector.
Prescriptive Incident Reporting Timelines
DORA imposes specific incident classification criteria and a three-stage reporting timeline — initial notification within 4 hours, intermediate report within 24 hours, and final report within 1 month. Entities without automated incident classification and reporting pipelines will struggle to meet these obligations.
ICT Third-Party Risk Is Extensive
DORA requires financial entities to maintain a complete register of all ICT third-party service providers, classify critical and important TTPSPs, include mandatory contractual provisions in TTPSP agreements, and support oversight of critical TTPSPs by EU supervisors. This is a multi-year compliance programme, not a one-time exercise.
TLPT for Significant Entities
Significant financial entities must conduct Threat-Led Penetration Testing (TLPT) at least every three years, involving red team operations based on threat intelligence from approved providers. TIBER-EU provides the methodology. As a CREST-certified firm, Intelliroot is qualified to conduct TLPT engagements under the TIBER-EU framework.
DORA Compliance Programme Scope
ICT Risk Management Framework
- ICT risk management framework gap assessment
- ICT asset inventory and classification
- Risk tolerance setting and ICT risk appetite
- Business continuity and ICT continuity planning
Incident Classification & Reporting
- ICT incident classification criteria implementation
- 4-hour / 24-hour / 1-month reporting pipeline design
- Major incident determination and escalation process
- Competent authority notification templates and procedures
Digital Operational Resilience Testing
- Basic DORA testing programme (VAPT, scenario testing)
- TLPT scope definition for significant entities
- TIBER-EU methodology alignment and engagement support
- Testing results remediation and tracking
ICT Third-Party Risk Management
- Complete ICT TTPSP register construction
- Critical/important TTPSP classification process
- Contractual provision gap analysis against DORA RTS
- Concentration risk and exit strategy assessment
Our DORA Compliance Approach
Applicability & Proportionality Assessment
Confirm the entity's DORA applicability category (financial entity or ICT TTPSP), apply the proportionality principle to define the applicable obligations, and map all relevant EBA/ESMA/EIOPA RTS requirements to the entity's specific profile and operations.
Gap Assessment
Conduct a structured gap assessment across all five DORA pillars — ICT risk management, incident management, resilience testing, third-party risk management, and information sharing. Produce a scored gap register covering every applicable RTS requirement.
ICT Third-Party Register & Contract Review
Build or validate the complete ICT TTPSP register, classify providers by criticality, and review existing contracts against DORA's mandatory contractual provisions. Identify contracts requiring amendment and prioritise by risk.
Incident Reporting Framework Design
Design the ICT incident classification framework, establish the 4-hour / 24-hour / 1-month reporting pipeline, create notification templates aligned to competent authority formats, and test the process through a simulated incident scenario.
Remediation Roadmap & TLPT Planning
Deliver a phased DORA compliance roadmap with effort estimates and implementation sequencing. For significant entities, define the TLPT scope and timeline in accordance with TIBER-EU methodology requirements.
Frequently Asked Questions
Deliverables
DORA Readiness Gap Assessment Report
Scored gap assessment across all five DORA pillars, mapped to applicable EBA/ESMA/EIOPA RTS requirements, with compliance status ratings and remediation priorities.
ICT Third-Party Risk Register
Complete ICT TTPSP register with provider classification (critical/important/standard), contractual provision gap analysis, and concentration risk assessment.
Incident Classification Framework
ICT incident classification framework implementing DORA criteria, with the 4-hour / 24-hour / 1-month reporting pipeline, notification templates, and process documentation.
TLPT Scope Definition
For significant entities: TLPT scope definition document aligned to TIBER-EU methodology requirements, covering target systems, Threat Intelligence Provider selection criteria, and testing timeline.
DORA Compliance Roadmap
Phased remediation roadmap with effort estimates, implementation sequencing, and milestone alignment to the DORA compliance cycle and supervisory examination calendar.
Request a Security Assessment
Tell us about your environment and security objectives. We'll design a bespoke assessment and deliver a detailed proposal within 48 hours.