Build the technology and evidence an in-scope firm needs for DORA

Why DORA changes financial services IT

DORA is an EU framework for specified financial entities and their management of ICT risk. It affects the way an in-scope firm documents systems, handles incidents, tests resilience and governs relevant suppliers.

Enforcement began on 17 January 2025. Since that date, digital operational resilience has been a board-level responsibility. Your ICT arrangements are not a procurement detail any more. They are a regulated function, open to supervisory scrutiny, mandatory testing and formal incident reporting.

For a London firm, the first question is scope. An EU entity covered by DORA has direct obligations. A UK firm may instead fall under the FCA’s operational resilience framework, face contractual requirements from an EU customer, or sit outside both regimes. The frameworks overlap, but they are not interchangeable.

Where mid-market firms get stuck on DORA

Large banks run dedicated technology risk teams. Sole traders sit below the threshold for the heaviest obligations. The firms that struggle sit in between.

Mid-sized in-scope firms often have limited internal technology-risk capacity. The work commonly slows around third-party contracts, the ICT risk framework and a testing programme sized to the actual risk.

That is the gap we fill.

The five DORA pillars

ICT risk management needs a living framework, not a policy written once and filed. Monitor your estate continuously. Identify, assess and mitigate risks on a documented cycle. Map every asset, every dependency and every point of failure.

Incident reporting needs your IT provider to classify incidents against DORA’s severity criteria. They escalate within the mandated timeframes and produce root-cause analysis a regulator will accept. Ad-hoc ticket queues and informal escalation paths do not survive scrutiny.

Resilience testing asks for more than an annual scan. You need vulnerability scanning, scenario-based testing and, above the threshold, threat-led penetration testing run by qualified external testers.

Third-party risk management is where most firms are furthest behind. Review every ICT contract against Article 30. Document exit strategies, audit rights, data handling obligations and subcontracting controls explicitly.

Information sharing stays voluntary. Firms that join sector threat-intelligence arrangements show a mature approach to resilience, and supervisors take note.

Managed IT that supports DORA readiness

Our managed IT support can provide the asset information, change records, monitoring and recovery evidence used by an in-scope firm. Contract terms and incident responsibilities are agreed for the services in scope rather than assumed to be identical for every client.

We start with a structured DORA gap analysis. We map your ICT arrangements against each pillar, show you where you fall short, and set out a remediation plan with dated milestones.

Then we coordinate resilience testing with specialist partners, run the vulnerability scanning cycle, and keep the documentation current. When your compliance officer or external auditor asks for evidence, it exists and you can reach it.

DORA has no finish line. Treat it as a one-off project and you will be back in remediation inside a year. Build it into how your IT is run and the evidence becomes a by-product of good operations.

The result is a maintained operating process rather than a document assembled once and left to date.