Audit
DORA Readiness Assessment: are you ready for a supervisory review?
Supervisors check whether your ICT risk management, incident reporting, resilience testing and ICT third-party providers actually work. We assess where you stand on each requirement and turn the gaps into a prioritised action plan.
Free and without obligation. You will receive your proposal within 48 hours.
What we check in the DORA assessment
We check where you stand against DORA and the related technical standards:
- Applicability: type of entity, proportionality and the simplified framework under Article 16
- Governance: responsibility of the management body and the ICT risk management framework
- ICT risk management: protection, detection, backup and business continuity, including a business impact analysis
- ICT incidents: classification and reporting process under Articles 17 to 19
- Resilience testing: testing programme under Articles 24 and 25
- ICT third-party providers: register of information, contracts under Article 30 and exit strategies
Your result: DORA compliance level and action plan
You know where you stand and what to do first:
- Compliance level for each DORA requirement, traceable for management and supervisors
- Gaps rated by risk and effort
- Prioritised action plan with effort estimate
- Basis for implementation with our DORA consulting
How your DORA Readiness Assessment works
We review with the eye of a CISA and ISO 27001 auditor:
- Initial conversation: type of institution, starting point, review dates.
- Your proposal with scope and approach
- Applicability: which requirements apply to you and to what extent.
- Review: documents, interviews and samples for each requirement.
- Results meeting with management and the people responsible, with action plan.
Why Securitects
- Knowing the financial sector from the inside: your senior consultant brings 8 years of ISMS experience in banking
- Find the gaps before the supervisor does: we assess to the standard of a CISA and ISO 27001 auditor
- What you already have counts: we take your ISO 27001 ISMS and existing contingency plans into account, so you only see the real DORA gaps
- Targeted next steps: you decide which measures you implement yourself and where we support you
Frequently asked questions about the DORA Readiness Assessment
Under Article 2, DORA applies to almost all supervised financial entities, such as credit institutions, payment and e-money institutions, investment firms, insurers and crypto-asset service providers. Whether and to what extent you are affected is something we clarify at the start of the assessment, including whether the simplified framework under Article 16 applies to you.
Because the review is what counts. Many companies put policies and processes in place on time, but supervisors ask for evidence that they work. The assessment shows where documentation and actual practice diverge, before an examiner finds out.
An ISMS covers many requirements for ICT risk management. Beyond that, DORA mainly requires the classification and reporting of major ICT-related incidents, a resilience testing programme, the register of information and minimum contents in contracts with ICT third-party providers. We focus on these, which saves time.
Yes. If your customers pass DORA requirements on to you by contract, we check whether you can demonstrably meet them, for example for security measures, support with ICT incidents, audit rights and exit support.
The readiness assessment is the first step and shows where you stand. With our DORA consulting we then support you through implementation, module by module.
No. The assessment is your internal review of where you stand. We do, however, proceed as in a supervisory review, with documents, interviews and samples, so that you know your gaps before the supervisor asks for evidence.
Helpful are your ICT risk management framework, policies, the register of information, contracts with key ICT third-party providers, contingency and recovery plans, test reports and records of ICT incidents. If any of these are missing, that is no obstacle: missing documents are a finding in themselves and go into the action plan. We treat your documents confidentially and use them solely for the assessment.
Effort and duration depend on your type of institution, the number of critical or important functions, the number of your ICT third-party providers and the maturity of your ISMS. If a supervisory review is coming up, tell us the date in the initial conversation so that there is enough time left for implementation afterwards.
Start your DORA Readiness Assessment
In the free initial conversation we clarify which DORA requirements apply to you.