DORA readiness for ICT suppliers
Since January 2025, your financial-sector clients have to manage you as an ICT third-party risk. We help you answer their questionnaires and contract clauses with real controls and evidence.
DORA readiness for ICT suppliers prepares software, hosting and IT service companies that serve banks, insurers, payment firms and other financial entities for the security requirements those clients now pass down under DORA (Art. 28–30). We implement and evidence the technical controls; we do not certify and we are not a TLPT provider. Projects start at €6,000 and take 3–6 weeks.
We gather what your clients have sent: addenda, questionnaires, audit requests, and agree the scope.
We check your actual infrastructure and processes against those asks and rank the gaps.
We build the missing controls through pull requests and write the procedures your team will really use.
An evidence pack and questionnaire answers, reviewed with you so your team can defend them.
A DORA-driven questionnaire usually comes down to the same handful of questions. Can you show who has access to systems that serve us? Do you detect and report incidents fast enough for us to meet our own deadlines? Can you restore our data, and have you tested it? Is every change to production reviewed and recorded? Could we leave your service in an orderly way?
If the honest answer today is “mostly, but it is not written down”, most of the work is making it real and provable.
We prefer evidence that produces itself. When infrastructure is in Terraform and Ansible, and every change goes through a pull request, the repository history becomes your change log. When backups are restored on a schedule and verified by checksum, the restore log becomes your continuity evidence. When access goes through a mesh VPN with policies in Git, the policy file is your access-control document.
That is the same discipline we run for payments infrastructure, and it lasts longer than a binder of policies written once for an audit.
We do not give legal advice on your contracts, we do not certify, and we are not a TLPT provider. We work on the technical controls and evidence, alongside your lawyers and your clients’ risk teams.
A European fintech processing payments, cards and crypto, with 20–50 people and a regulated core. We lead its DevOps over the long term: infrastructure as code, PCI DSS controls, payments connectivity and disaster recovery.
DORA applies directly to financial entities. But they must manage their ICT suppliers, keep a register of them, and put specific clauses into contracts (Art. 28–30). So if you supply software or IT services to them, the requirements reach you through your contracts and questionnaires.
From €6,000 excluding VAT for a small supplier with a clear scope. The fixed quote depends on how many systems serve financial clients and how much already exists.
Usually 3–6 weeks. If a client has given you a deadline, tell us; we can do the most visible items first.
No, and nobody can certify a supplier as 'DORA compliant' in that sense. We implement the controls and prepare the evidence your clients ask for. Their own assessment decides whether you meet their requirements.
No. TLPT is for certain financial entities and is done by accredited testers. We can help you prepare your infrastructure and evidence before such a test.
Largely, yes. Access control, logging, backups, incident handling and change control are the same engineering work. We write the evidence so you can reuse it.
Send it to us, or describe what your client is asking for. We will tell you which items you can already answer and what needs work.