Digital Operational Resilience Act (DORA)

The DORA Regulation establishes a harmonised framework for strengthening ICT risk management and operational resilience across the EU financial sector..

The DORA Regulation aims to enhance the financial sector’s operational resilience in the EU and to harmonise the rules and standards for the financial entities’ use of information and communication technology (ICT). The DORA Regulation will apply to various financial entities, such as banks, insurance companies, investment firms, payment service providers, and crypto-asset service providers. The DORA Regulation will require the entities to adopt appropriate ICT risk management measures, conduct regular testing and self-assessments, and report on incidents and disruptions.

Stages of the DORA Lifecycle

Assessment and Gap Analysis

Self-assessment and gap analysis are essential steps, and we are ready to support you in this important endeavour. For this, we have developed a DORA compliance tool designed for self-assessment.

DORA Compliance Self-Assessment Tool by ECOVIS

Start your journey towards DORA compliance with our self-assessment tool. This tool helps financial institutions evaluate their readiness for DORA’s regulatory requirements, which will be in full effect by January 2025.

We developed the DORA Compliance Self-Assessment Tool to support organisations in evaluating and strengthening their digital resilience. This tool provides a detailed analysis of your company’s compliance status, covering essential areas such as ICT risk management, incident reporting, resilience testing, and third-party management.

With approximately 200 targeted questions, the tool ensures a comprehensive review of digital resilience and operational risk management practices.

The DORA Compliance Self-Assessment Tool by ECOVIS covers the following areas:

Governance and Organisation
ICT Risk Management Framework
ICT Systems, Protocols, and Tools
Backup Policies, Restoration, and Recovery Procedures
ICT-Related Incident Management Process
Classification of ICT-Related Incidents and Cyber Threats
Reporting of Major ICT-Related Incidents and Voluntary Notification of Significant Cyber Threats
Digital Operational Resilience Testing
Testing of ICT Tools and Systems
Advanced Testing of ICT Tools, Systems, and Processes (TLPT)
Managing ICT Third-Party Risk
ICT Concentration Risk
Key Contractual Provisions
ICT Security Policies, Procedures, Protocols, and Tools

How to get access to the DORA Compliance Tool by ECOVIS

This tool provides a comprehensive framework for evaluating your current compliance status and identifying areas for improvement. While completing the questionnaire does take some time, it is invaluable in preparing your organisation for the upcoming requirements.

Book an initial call with our expert.

Our DORA services

Assessing your current security posture and compliance level with the DORA
Identifying the gaps and risks in your network and information systems and providing recommendations for improvement
Designing and implementing security policies, procedures, and controls that meet the DORA requirements
Providing training and awareness programs for your staff and stakeholders on the DORA obligations and best practices
Assisting you in reporting incidents and breaches to the relevant authorities and stakeholders
Preparing you for audits and inspections by the competent authorities and providing support during the process
Helping you manage and mitigate the impact of any sanctions or enforcement actions

Frequently Asked Questions

Postponement of the auditor’s visit during a tax audit

My company has just received a notice of accounting audit. I would like to change the date of the controller’s first visit to our premises. Is this possible?

Absolutely. You can indeed request the postponement of this first on-site intervention. But to do this, you must quickly formulate your request in writing. And be careful, the tax authorities are not obliged to accept it. Your request can only be accepted if the reasons you invoke seem serious. This may be the case, for example, if your accountant is absent or if your company is closed due to holidays. Generally, if it accepts your request, the administration informs you of the new date by registered letter with acknowledgement of receipt, and not by a corrected verification notice.

Employee Performance Appraisal Interview

Scope of the legal guarantee of conformity

CFE Declaration Requirements Following a Company Takeover with Premises