European UnionOperational resilienceEffective January 17, 2025
DORA

Digital Operational Resilience Act

ICT risk management, incident reporting, third-party oversight including AI service providers.

Depth of coverage

What we know in this framework.

The specific clauses, articles, appendices and supervisory expectations we work against — anchored to primary source and maintained as the regime evolves.

01ICT risk framework
02Incident classification
03Threat-led penetration testing
04Third-party register
How we cover it

How the firm carries DORA into client work.

DORA is read against the services below. Each one draws on the same compliance intelligence layer — indexed to primary source, versioned alongside the regulator, and carried into the engagement.

Related playbooks

Playbooks that ship against DORA.

Each playbook walks from discovery through artifact — phases, controls, evidence. Agents assist the mechanical steps; specialists own the sign-off.

Map your posture against DORA.

Bring us your current documentation, controls and inventory. We will map them clause by clause against DORA — and against every other regime your portfolio touches — and produce the evidence artifact your supervisor will read.