Support 24/7: +48 61 646 07 77
We prepare financial institutions and their suppliers to meet the requirements of the DORA regulation. We check and assess gaps, implement key policies and processes (ICT risk, incidents, resilience testing, business continuity, suppliers) and organise infrastructure: 24/7 monitoring, backups, HA and a complete set of documents for audit.
A DORA audit (gap assessment) is a structured review of your processes and infrastructure against the five pillars of DORA. We work with documents and configurations, speak with the team, review architecture, logs, RTO/RPO and alert thresholds.
Areas covered include risk and incidents, business continuity (BCM/DRP), 24/7 monitoring, backup/HA, identity and access management (IAM), vulnerabilities/patching, registers, and collaboration with suppliers.
The result is a gap map with impact assessment, division into quick wins and projects, and a roadmap with owners and KPIs, plus a list of missing policies/procedures/registers (evidence pack). This way you know what to do first and why.
The result: a coherent, practical set of documents and artefacts that the team actually works with—not just paperwork for the audit.
Technical implementation for DORA means translating regulatory requirements into specific controls within your infrastructure, making it manageable, measurable and auditable.
What is done:
The result is full control of supply-chain risk and predictable service provider changes—without chaos and with a complete set of audit evidence.
We support financial institutions and their suppliers in the practical implementation of DORA. Procedural and technical layers are combined: 24/7 monitoring, backups with restoration tests, HA/DR and strict runbooks. We organise registers, map requirements to RTS/ITS, automate reporting (4h/24h/72h/1 month) and prepare a complete evidence pack. We deliver solutions across private and public cloud environments, collaborating closely with security teams and software houses.
Evidence pack ready for audit
24/7 monitoring
Backups with restoration tests
Reporting to supervisory authorities
HA/DR and hardening
SLA & suppliers
In what ways is your DORA implementation more than "just documentation"? What do you actually deliver?
We do not just produce policies; we implement working processes and controls.
What we deliver specifically:
What is the first step of cooperation and what data do you need to get started?
A short kick-off call (30–45 min) + NDA. We define the scope, process owners and read-only access. We send a checklist and export formats.
What we need to get started (minimum):
"DORA: from when?" — what are the key dates and milestones (including RTS/ITS)?
Key DORA dates (summary):
Can you integrate DORA processes with our tools (Jira/ServiceNow, SIEM, monitoring, ITSM)?
Yes. We integrate DORA processes with your stack without replacing any tools, or recommend changes for the future.
What we do in practice:
What does the DORA audit (gap assessment) look like and what does it cover?
Audit process (in brief):
Scope in line with DORA:
Do you support on-prem, private cloud and public cloud environments (AWS/Azure/GCP)?
Yes, absolutely.