EU financial services

Operational resilience for financial services and their ICT ecosystem.

The Digital Operational Resilience Act sets a common EU framework for ICT risk management, incident handling, resilience testing, and ICT third-party risk in the financial sector. We help firms move from policy to repeatable operations and evidence.

Our implementation focus

Make the requirements operational.

  1. 01

    Assess ICT risk management maturity

  2. 02

    Design incident classification and reporting processes

  3. 03

    Strengthen resilience testing and exercises

  4. 04

    Build ICT third-party oversight and registers

  5. 05

    Align governance and management reporting

Independent assessment

DORA has applied since 17 January 2025. Specific obligations depend on the entity and regulatory role.

The delivery path

A sequence you can operate.

Each step leaves a clear decision or working artifact behind.

01 / 03

Determine the entity role

Identify the regulated entity, its important functions, ICT services, suppliers, and the DORA duties relevant to its role. Resolve legal classification with counsel.

Output: Entity, function, and supplier scope map
02 / 03

Design the operating controls

Connect ICT risk ownership, incident classification, testing, and third-party oversight to accountable teams and normal evidence flows.

Output: Control and reporting responsibility matrix
03 / 03

Exercise and improve

Test disruption and escalation scenarios, inspect supplier records and exceptions, and review whether leadership receives information it can act on.

Output: Exercise results and remediation roadmap

Questions we hear

Get the distinctions right.

Does DORA apply to every technology provider serving a bank?

No. Direct duties depend on the entity’s role and the regulation. Financial customers may also place contractual requirements on ICT providers. Confirm the relevant position before designing the program.

Can an ISO/IEC 27001 certificate establish DORA compliance?

No. Security management can support DORA controls, but incident, testing, supplier, governance, and reporting duties require their own analysis and evidence.

Practical guidance

Read the next decision.

Executive briefing3 min read

DORA

DORA is an operating model, not a document set

Where ICT risk, incidents, testing, and third-party oversight meet in day-to-day operations.

Read resource

Work with Normstone

Build a defensible path to readiness.

Tell us the outcome you need and the markets involved. We’ll help define the work.

Start a conversation