Question 1

Who is in scope for DORA?

Accepted Answer

DORA applies to virtually all EU financial entities — credit institutions, payment institutions, investment firms, insurance and reinsurance, IORPs, crypto-asset service providers, and central counterparties — plus designated critical ICT third-party providers. Swiss firms providing services into EU financial entities are typically pulled in through contractual flow-down, even if not directly regulated.

Question 2

How does DORA differ from NIS2 for financial entities?

Accepted Answer

For entities in scope of both, DORA acts as lex specialis — its ICT-related provisions take precedence over NIS2. Practically, you build under DORA and align NIS2 governance and supply-chain elements on top. Where DORA requires more detail (incident classification, TLPT, register data fields), DORA wins.

Question 3

Who must perform threat-led penetration testing (TLPT)?

Accepted Answer

Competent authorities identify TLPT-subject entities based on size, ICT risk, and systemic importance — typically the larger banks, insurers, and central counterparties. If you are not yet identified, you are not required to perform TLPT, but you should still have a digital operational resilience testing programme proportionate to your risk.

Question 4

How deep does third-party oversight go?

Accepted Answer

You must oversee the ICT third-party itself and, for services supporting critical or important functions, gain visibility into key subcontractors. Exit strategies and concentration-risk assessments are mandatory. We help draft the contract amendments and the operational diligence package required to evidence this.

Question 5

What incident reporting timelines must we meet?

Accepted Answer

Major ICT-related incidents trigger an initial notification within 24 hours of classification, an intermediate report within 72 hours, and a final report within 1 month. Significant cyber threats are reported on a voluntary basis. Your classification methodology must be defensible — many firms underestimate "major" status and are then challenged on it.

Question 6

What does a DORA programme typically cost?

Accepted Answer

For a mid-market financial entity, a full DORA implementation runs 80-150 advisor person-days over 4-6 months, depending on existing ICT risk and outsourcing maturity. Firms with existing ISO 27001 and operational resilience programmes (e.g., from PRA SS1/21 or FINMA expectations) can sometimes complete in less.

DORA operational resilience for financial entities under EU oversight

What you get in 90 days

Scope, governance, ICT register baseline

Contract templates, incident playbook, resilience plan

TLPT planning, audit-ready evidence pack

Our DORA Integration Method

ICT Risk Assessment & Gap Analysis

Deliverables:

ICT Risk Management Framework

Deliverables:

Operational Integration

Deliverables:

Testing & Validation

Deliverables:

Expected Outcomes

Frequently asked questions

Ready to start? Book a 30-min scoping call.