DORA
Your financial service must be able to continue when technology fails.
Your customers' trust also depends on how you withstand a disruption. We support you in DORA preparation and improvement, connecting technology risk, continuity, suppliers and evidence with the reality of the financial service.
01 / 08
The incident cuts across more areas than the IT department
When a critical service fails, operations, risk, management and suppliers all come into play. Preparation shows in how they coordinate. We review those dependencies and the controls that must support them, so that plans relate to what happens in practice.
02 / 08
Continuity is worked on several fronts
| Front | Focus |
|---|---|
| Service | Functions that must be maintained or recovered. |
| Technology | Systems and controls they depend on. |
| Third parties | Dependencies, commitments and alternatives. |
03 / 08
Resilience across functions, systems and third parties
- 01
The service as the reference
We link systems and third parties to the functions that must be maintained.
- 02
Suppliers under a common view
We review dependencies, evidence and continuity and exit needs.
- 03
Verifiable response capability
We work on incident organisation, testing and follow-up of improvements.
04 / 08
From dependencies to a resilience plan
Scope
Entity, functions and requirements that apply.
Cross-check
ICT risk, third parties, incidents and testing.
Strengthen
Prioritised actions and evidence for follow-up.
05 / 08
What you take away from the work
- Map of gaps and technology dependencies.
- Resilience improvement plan.
- Organisation of evidence and follow-up responsibilities.
06 / 08
Designed for your reality
Financial entities within scope
A shared view for management, risk, compliance and technology.
Technology providers to the sector
Preparation of contractual and operational assurances according to their role, without automatically equating them to a financial entity.
07 / 08
Frequently asked questions
No. A distinction must be made between the financial entities included, the contractual obligations of their suppliers and the specific regime for designated critical ICT providers.
Preparation also requires reviewing controls, dependencies, incident management and the applicable resilience testing.
No. The requirement for tests such as TLPT depends on the regime and the corresponding selection. The work suited to the entity is determined.
08 / 08
Services that complement this work
Let's work on continuity with the same rigour as your service.
Let's review which functions are critical, who they depend on and what you need to be able to demonstrate.