DORA Compliance
DORA became enforceable on January 17, 2025. Financial entities without full compliance across all 5 pillars face immediate penalty exposure: up to €10 million or 2% of total annual worldwide turnover, plus €1M personal fines for management board members. We deliver gap analysis, TIBER-EU TLPT, 24-hour incident reporting validation, and third-party ICT contract remediation in a single CREST-accredited engagement.
Five Pillars.
One Engagement.
DORA compliance is not a checkbox. We assess all five pillars in a single engagement: ICT risk management, incident reporting readiness, TIBER-EU threat-led penetration testing, third-party ICT risk assessment, and information sharing validation.
ICT Risk Management Framework
Assessment and validation of your DORA Article 6-16 ICT risk management framework. We evaluate governance structures, risk identification processes, protection and prevention measures, detection capabilities, and response and recovery procedures against DORA requirements for maintaining digital operational resilience.
24-Hour Incident Reporting
Validation of ICT incident classification, escalation workflows, and 24-hour reporting timelines to competent authorities. We test your ability to classify major incidents, validate reporting procedures under DORA Article 19, and assess root cause analysis capabilities for post-incident learning.
Threat-Led Penetration Testing
Advanced penetration testing simulating real-world threat actors targeting financial services. DORA requires TLPT every 3 years for critical entities. Our testing follows TIBER-EU methodology: targeted intelligence-based threat scenarios, controlled attack simulations, and comprehensive resilience validation.
Third-Party ICT Risk Management
Assessment of third-party ICT dependencies, contractual arrangements, and concentration risk. We evaluate DORA Article 28-30 vendor management processes, validate obligations in supplier contracts, assess critical third-party service providers, and test exit strategies for key ICT outsourcing arrangements.
Digital Resilience Testing & Validation
Comprehensive digital operational resilience testing covering vulnerability assessments, scenario-based testing, and red team exercises. We validate RTOs, backup restoration procedures, failover mechanisms, and business continuity plans against DORA Article 24-25 requirements.
Information Sharing Arrangements
Establishing and validating DORA Article 45 threat intelligence exchange mechanisms with peers and authorities. We assess your participation in financial sector information sharing arrangements, validate secure communication channels, and ensure compliance with data handling obligations.
DORA Non-Compliance Risk Profile
DORA became enforceable on January 17, 2025. Supervisory authorities are now conducting assessments and can take immediate enforcement action for non-compliant entities.
Or 2% Global Turnover
Whichever is higher, for legal persons. Plus €1M personal fines for management board members.
Entity Types
Banks, payment institutions, investment firms, insurers, crypto-asset providers, and critical ICT third parties.
TLPT Cycle
Threat-led penetration testing every 3 years for critical entities, using TIBER-EU methodology.
Pillars
When Do Organisations Commission DORA Assessment?
DORA compliance engagements are typically triggered by one of these six scenarios. If any of these apply, you are in the right place.
€10M Penalty Exposure
DORA became enforceable on January 17, 2025. Supervisory authorities are conducting assessments. Non-compliance carries penalties up to €10M or 2% global turnover.
TLPT Deadline Approaching
Your entity has been designated critical or important. TIBER-EU TLPT is mandatory every 3 years and must be conducted by independent testers with financial sector expertise.
UK Firm with EU Exposure
You have EU subsidiaries, branches, EU clients via equivalence, or provide ICT services to EU financial entities. Brexit does not exempt EU operations from DORA.
Third-Party ICT Audit
Your regulator or clients require evidence of DORA Article 28-30 third-party ICT risk management, including audit rights, exit strategies, and subcontracting restrictions.
Incident Reporting Gap
You cannot currently classify major ICT incidents and report to competent authorities within 24 hours. DORA requires initial, intermediate (72-hour), and final (1-month) reporting.
EU Market Entry Planning
EU regulators require evidence of DORA-aligned ICT operational resilience before granting market access. Proactive compliance enables faster EU expansion.
Mapped directly to your regulatory controls.
Our CREST-certified report includes a compliance mapping matrix that cross-references DORA pillar findings to the specific framework clauses your supervisory authority requires.
DORA
Full Digital Operational Resilience Act compliance assessment
TIBER-EU
Threat-led penetration testing methodology for critical entities
FCA PS21/3
UK operational resilience framework alignment
PCI DSS v4.0
Payment card penetration testing and vulnerability management
UK GDPR
Appropriate technical measures for data protection
SWIFT CSP
SWIFT Customer Security Programme compliance
Globally Accredited Consultants
All testing is conducted by CREST-certified professionals with financial sector expertise.
Engagement Workflow
Structured to minimise operational friction and maximise the value of the testing window.
Gap Analysis & Scoping
Initial assessment of your current ICT risk management posture against DORA's 5 pillars. We identify compliance gaps, prioritize remediation areas, and define the scope of TLPT activities.
ICT Risk Framework Validation
Validation and enhancement of ICT risk management frameworks, incident reporting procedures, and governance structures. We test incident classification workflows and validate 24-hour reporting capabilities.
TLPT Execution (TIBER-EU)
Advanced TLPT engagement simulating sophisticated threat actors targeting your critical ICT systems. Intelligence-led attack scenarios, detection and response testing, and recovery validation.
Reporting & Regulatory Submission
Comprehensive DORA compliance report with gap analysis, TLPT findings, incident response validation, and remediation roadmap. Evidence packages formatted for supervisory authority assessment.
What You Get
Every DORA compliance engagement includes the following deliverables, formatted for both technical teams and supervisory authority submissions.
Reports are delivered via encrypted portal with role-based access. Evidence packages structured for EBA, ESMA, and EIOPA assessment requirements.
DORA Is Ongoing.
Not One-Time.
DORA compliance is not a one-time exercise. Supervisory authorities will assess ongoing adherence. We feed your DORA assessment findings into our 24/7 Managed SOC and continuous vulnerability management, building custom detection rules for your ICT infrastructure and monitoring for third-party risk changes between TLPT cycles.
Explore Defensive ServicesManaged Detection & Response
24/7 SOC monitoring with detection rules tuned to your DORA assessment findings.
Managed Detection & Response
Continuous ICT monitoring and threat detection between TLPT cycles.
Red Team Operations
Full-scope adversarial simulation beyond TLPT for advanced resilience validation.
Incident Response
Retainer-based response capability supporting DORA 24-hour reporting requirements.
Full Penetration Testing Catalogue
Comprehensive penetration testing services tailored to your environment.
Internal Testing
Post-perimeter assessments targeting Active Directory, lateral movement, privilege escalation, and segmentation validation from inside your network.
The best time to test your defences is now.
Join the high-growth companies relying on Precursor for continuous offensive and defensive security.
Frequently Asked Questions
Common questions about this service, methodologies, and deliverables.
DORA applies to UK financial institutions through multiple mechanisms despite Brexit. UK firms with EU subsidiaries or branches must achieve DORA compliance for those EU operations — Brexit does not exempt EU subsidiaries or branches from EU financial regulation. UK firms serving EU clients through regulatory equivalence, third-country licensing, or local authorisations must demonstrate DORA-compliant ICT operational resilience to EU supervisory authorities. UK ICT third-party service providers designated as critical under DORA Article 31 face direct supervisory oversight regardless of location — UK cloud providers, payment processors, and fintech platforms serving EU banks fall under DORA oversight even as non-EU entities. UK firms planning EU market entry must also demonstrate DORA compliance as a prerequisite for authorisation. Even firms without a direct regulatory obligation face commercial pressure: EU clients increasingly mandate DORA-equivalent ICT resilience in vendor contracts, and RFPs specify DORA alignment as a selection criterion. Most UK financial institutions with any EU exposure should assume DORA applicability and conduct a gap analysis. UK firms should consult legal counsel on specific obligations rather than assuming Brexit exemption.
DORA applies to all EU financial entities: credit institutions (banks), payment institutions, electronic money institutions, investment firms, crypto-asset service providers, insurance and reinsurance undertakings, central securities depositories, and critical ICT third-party service providers. Non-EU firms with EU operations or clients may also fall within scope. The regulation is effective from January 17, 2025, with mandatory compliance for all in-scope entities.
The Digital Operational Resilience Act establishes 5 key pillars: (1) ICT Risk Management: governance frameworks, risk identification, and protection measures; (2) ICT-Related Incident Reporting: classification and 24-hour reporting of major incidents to regulators; (3) Digital Operational Resilience Testing: vulnerability assessments, scenario testing, and TLPT every 3 years; (4) Third-Party ICT Risk Management: vendor oversight, contractual obligations, exit strategies; (5) Information Sharing: threat intelligence exchange among financial entities.
Threat-Led Penetration Testing (TLPT) is mandatory every 3 years for entities identified as critical or important under DORA. TLPT follows TIBER-EU methodology: intelligence-led threat scenarios based on real adversary tactics, controlled exploitation of vulnerabilities without causing operational disruption, testing of detection and response capabilities, and validation of recovery procedures. Tests must be conducted by independent testers with appropriate financial sector expertise.
Major ICT-related incidents must be reported to competent authorities within 24 hours of classification. This initial notification includes incident classification, estimated impact, and preliminary indicators of compromise. An intermediate report is required within 72 hours with updated impact assessment and remediation progress. A final report is due within 1 month, including root cause analysis, lessons learned, and preventive measures. Significant cyber threats must also be reported when detected.
DORA imposes strict requirements on third-party ICT service provider arrangements. All contracts must include DORA-specific obligations: right to audit, data access and portability provisions, notification requirements for incidents and changes, exit strategies with defined timelines, and sub-contracting limitations. Financial entities must maintain a register of all ICT third-party providers, assess concentration risk from using common suppliers, and implement alternative solutions to avoid vendor lock-in for critical services.
DORA violations can result in significant penalties: up to €10 million or 2% of total annual worldwide turnover for the preceding business year (whichever is higher) for legal persons. Natural persons (individuals) face fines up to €1 million. Additional sanctions include public warnings, temporary bans on activities, withdrawal of authorisations, and personal liability for management bodies. Supervisory authorities may also impose periodic penalty payments to compel compliance and remediation.
Immediate action is required: (1) Conduct a rapid gap analysis against the 5 pillars to identify and prioritise compliance deficiencies; (2) Enhance ICT risk management frameworks with DORA-specific governance structures; (3) Implement incident classification and 24-hour reporting capabilities to supervisory authorities; (4) Review and update all third-party ICT contracts with DORA obligations including audit rights, exit strategies, and subcontracting restrictions; (5) Plan and schedule TLPT engagements (mandatory every 3 years for critical entities); (6) Establish information sharing arrangements with peers and authorities. Supervisory authorities are now conducting assessments and can take enforcement action for non-compliance. Engaging specialist support accelerates remediation and demonstrates good faith to regulators.