Implement DORA now — document ICT risks, the RoI and your reporting processes so they stand up to scrutiny
We support financial entities & ICT third-party providers with the gap analysis, ICT risk management, the Register of Information, incident reporting, third-party governance and ongoing DORA documentation.
- Scope assessment for financial entities & ICT third-party providers
- Full service 9,000 – 29,900 € depending on company size
- 4–6 months to auditable DORA documentation
- Setup of your ISMS platform — subscription separate, also for ongoing compliance
- 30 minutes assessment
* Audit success relates to completed full-service certification projects since 2019. Client numbers include ISMS platform licence holders and full-service projects.
This page is for you if …
- … you fall under DORA as a financial entity .
- … you need a ICT risk management framework .
- … you need a Register of Information (RoI) under Art. 28.
- … you want to prepare for TLPT (threat-led penetration testing) .
- … you want to know what DORA compliance costs and how long it takes.
Three building blocks. One route to compliance.
Operational resilience for financial entities — ICT risk, the third-party register, TLPT support and reporting to the supervisor.
Full-service support
The DORA framework built and documented — from the ICT risk policy to the Register of Information.
- ICT risk management framework
- Register of Information (Art. 28)
- Incident reporting process
- Third-party governance
External ICT risk officer
A senior expert for your ICT risk management, facing BaFin and the auditors.
- Support with BaFin reporting
- Quarterly risk reports
- Board briefings
- Support during inspections
Internal audit
A DORA readiness audit before the supervisor looks at you.
- DORA gap analysis
- RoI quality review
- TLPT readiness check
- Final report for the board
Additionally for DORA
Standard-specific extras — bookable individuallyRegister of Information (RoI)
Building and maintaining your DORA register, including the annual update.
TLPT coordination
Threat-led penetration testing with certified partners.
Supplier classification
Criticality assessment of your ICT third parties under Art. 28 et seq.
Clarity on DORA in 30 minutes
We establish whether DORA applies to you, which evidence is missing and what the sensible next steps are. An honest estimate instead of blanket promises, and no sales pressure.
- The fastest answer we can give
- Realistic figures for time and cost
- No sales pressure, no obligation
- From notivia GmbH, Stuttgart — since 2019
Two tools — ready to use right now
Before you get in touch: work out the cost and explore the platform — free and without obligation.
Does DORA apply to you?
10 questions on sector, size and activity. Know straight away whether DORA is mandatory for you.
Or do it yourself
The ISMS platform with its DORA module
The multi-standard ISMS digitalises ICT risk management, the Register of Information and TLPT preparation — made for internal teams that want to maintain the RoI, ICT risks and evidence digitally.
Explore the platformDORA guide for financial entities
What the regulation requires, which deadlines apply, what the management board needs to know — explained plainly.
The DORA framework at a glance
DORA rests on five central pillars of digital operational resilience.
ICT risk management
A comprehensive framework for managing all ICT risks, including governance and controls.
Incident reporting
Classifying and reporting major ICT incidents to the supervisor.
Resilience testing
Regular testing of digital operational stability, including threat-led penetration testing (TLPT).
ICT third parties
Managing and monitoring ICT third-party risk along the whole supply chain.
Information sharing
Voluntary sharing of threat intelligence between financial entities.
What DORA asks of you
The main duties under Regulation (EU) 2022/2554
ICT risk management framework
The management body must define, approve and oversee an ICT risk management framework (Art. 5–16).
ICT incident management & reporting duties
Classifying ICT incidents, reporting them to the supervisory authorities and documenting them (Art. 17–23).
Digital operational resilience testing
Regular resilience testing, penetration testing and threat-led testing (TLPT) (Art. 24–27).
ICT third-party risk management
Contractual arrangements, the register, concentration risk and exit strategies for ICT outsourcing (Art. 28–44).
ICT information register
A complete register of every contractual ICT arrangement with third parties (Art. 28(3)).
Governance & management responsibility
The management body carries overall responsibility for ICT risk and must be trained regularly (Art. 5).
Reporting ICT incidents under DORA
Initial report to the supervisor
Immediate notification of a major ICT incident — at the latest 24 hours after becoming aware of it.
Interim report with analysis
A detailed analysis of the incident, an impact assessment and the status of the countermeasures.
Final report
A complete report with root cause analysis, the measures taken and proposed improvements.
Heavy fines
The EU supervisory authorities can impose substantial sanctions — including daily penalty payments of up to 1 % of average daily turnover.
Personal responsibility
The management body is personally responsible for implementing and overseeing ICT risk management.
Does your company fall under DORA?
DORA covers almost the entire financial sector — from banks through insurers to crypto service providers and their critical ICT suppliers.
Directly in scope financial entity
- Credit institutions & payment providers
- Insurers & reinsurers
- Investment firms & trading venues
- Crypto service providers & e-money institutions
- Fund managers & pension funds
Indirectly in scope ICT third-party providers
- Cloud providers (IaaS, PaaS, SaaS)
- Software and platform providers
- Data analytics and reporting services
- IT security service providers
- Managed service providers (MSPs)
21 categories of financial entity
What has to be in place for ISO 27001?
Eight building blocks — the mandatory set for DORA compliance.
- ICT risk management framework (Art. 5–15)
- Incident management & reporting (Art. 17–23)
- Digital resilience testing (Art. 24–27)
- ICT third-party risk management (Art. 28–44)
- Register of Information (Art. 28)
- Threat-Led Penetration Testing (TLPT)
- Board duties & training
- Communication with authorities & reporting (Art. 19)
In the initial call we show you which points you already meet.
Book a free initial assessmentISO 27001 as the a strong basis for DORA
ISO 27001 is a strong basis for DORA — but it does not replace it. Many building blocks such as risk management, incident management, supplier management, business continuity and internal audit can be reused. DORA adds specific requirements for the Register of Information, ICT third parties, reporting processes, resilience testing and supervisory documentation.
Implementing DORA with iso-easy
Gap analysis
Comparing your existing measures against every DORA requirement and identifying the gaps.
Build the ICT framework
Implementing the risk management framework and setting up the ICT third-party register.
Integrate the ISMS
Using ISO 27001 as the base and adding the DORA-specific extensions.
Compliant for the long run
Ongoing monitoring, resilience testing and reporting in a PDCA operating mode.
Build the Register of Information
We structure ICT third parties, contracts, critical functions, outsourcing and the upkeep processes into one auditable DORA register.
- A structured record of every ICT service provider
- Classification by criticality (Art. 28)
- Contract mapping and outsourcing documentation
- Ongoing upkeep processes for reports to the authorities
