Transform your operational resilience

How can your organisation evidence its compliance with DORA?

Recently published ESA guidelines, which various central banks have also echoed, create a tight timeline for showing evidence of compliance.

Most central banks expect to receive the information registers by early April 2025, which aligns with the next steps of register consolidation, evaluation, and use for Critical ICT third-party service providers (CTPPs), aiming to designate the CTPPs and start the oversight engagement this year.

Your organisation register must include the required details, which are typically unavailable; therefore, it takes time to compile and validate it. This includes mapping all ICT assets, documenting dependencies, and classifying services according to their criticality to your business operations.

DORA compliance is not a one-off exercise. It requires an ongoing programme of risk management, incident reporting, resilience testing, and third-party oversight that must be embedded into your organisation's governance structure.

In our workshops, we will help you evaluate your current level of ICT compliance and provide a relevant structure to manage it efficiently. We can also support your organisation by outsourcing various compliance processes to us.

Now is the time to ask yourself critical questions

• Do you believe that your organisation is resilient or not?
• Are you fully aware of all the services provided by and all the dependencies to your third-party ICT providers?
• Do you have a good grasp of all ICT related incidents?
• Can you recover a critical solution to support your customers in the next 4 to 8 hours?

In a world of constant change, you need to serve your customers and markets continuously in the best possible way. Your stability is essential — therefore, being well prepared is crucial.

The EU Digital Operational Resilience Act (DORA) is a complex regulation that requires significant attention across your entire organisation. From board-level governance to day-to-day ICT operations, every layer of your business must understand its role in maintaining digital operational resilience.

Our training programmes are designed to give your teams the knowledge they need, while our expert workshops provide hands-on guidance for building a compliant and resilient operation.

Is your DORA register a risk tool, or just a filing?

Fifteen months into DORA, the Register of Information has been submitted by most firms — and forgotten by most of them. The dry-run produced a 6.5% data-quality pass rate among 1,039 voluntary early adopters. The analytical fields on substitutability, alternatives, and sub-outsourcing chain were systematically left blank, and the register that was meant to be an internal risk artefact has been treated as an annual filing. Meanwhile, the 19 designated Critical ICT Third-Party Providers represent 0.13% of the financial sector's ICT supply — and incidents like ION Group and ICBC FS keep originating in the other 99.87%. Read our two-part analysis: the DORA Register of Information trap and what the Critical 19 CCTP list actually tells us, including the subcontracting chain, the on-prem/co-location segment the cloud-native framing misses, and the sovereignty profile of EU financial-sector ICT.

Can you run your BCP from a phone?

Give an authorised responder an approved phone, take away the laptop and start a ten-minute timer. Can they find the current plan, see who activates it, read the first actions and reach the response team? If not, the plan sits behind the same identity provider, email and document store that just failed. DORA Article 11 and RTS 2024/1774 require continuity tests built on severe but plausible scenarios that challenge the assumptions the plans rest on, and ISO 22301 requires plans to be available at the time and place they are needed. Our analysis covers what breaks in a real test, from circular dependencies and expired break-glass secrets to RTO figures the architecture cannot deliver, and why frequent automated recovery is the only durable answer: If you can’t test your BCP right now, from your phone, you don’t have a BCP.