Operational resilience, built and proven.
The EU Digital Operational Resilience Act (DORA) sets one standard for how financial entities manage ICT risk, report incidents, test resilience and oversee technology suppliers. Cybergen helps financial entities and their ICT providers get there.
The five pillars of DORA
One rulebook for financial sector resilience
DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025. As a regulation, it applies directly across the EU to banks, insurers, payment and e-money institutions, investment firms, crypto-asset service providers and many other financial entities.
It also reaches technology suppliers: ICT providers must support their financial customers' obligations, and critical ICT third-party providers can be designated for direct EU oversight. Buying a tool alone does not make anyone compliant.
What DORA asks of you
Select a pillar to see the key requirements and how Cybergen can help.
ICT risk management
A comprehensive, documented framework to identify, protect, detect, respond to and recover from ICT risk, owned by the management body.
What it asks of you
- Governance with clear management body accountability
- Asset identification and classification
- Protection, detection and recovery capabilities
- Backup, restoration and continuity plans
How Cybergen helps
ICT risk framework gap assessments, policy development and vCISO support for governance.
Virtual CISOIncident management and reporting
Detect, classify and manage ICT-related incidents, and report major incidents to the competent authority within set timeframes.
What it asks of you
- Incident management process
- Classification against DORA criteria
- Initial, intermediate and final reports
- Root cause analysis and lessons learned
How Cybergen helps
Incident response planning, classification playbooks and 24x7x365 detection and response.
24x7x365 MDRDigital operational resilience testing
A risk-based testing programme, with advanced threat-led penetration testing (TLPT) at least every three years for entities identified by their authorities.
What it asks of you
- Annual testing of critical systems
- Vulnerability assessments and scenario tests
- Threat-led penetration testing where required
- Remediation of findings
How Cybergen helps
CREST penetration testing, red teaming, threat intelligence and testing programme design.
Red and purple teamingICT third-party risk
Manage the risk of ICT service providers throughout the relationship, with mandatory contract provisions and a register of information.
What it asks of you
- ICT third-party risk strategy
- Register of information on ICT arrangements
- Due diligence and contract provisions
- Exit strategies for critical services
How Cybergen helps
Supplier risk assessments, register of information support and contract requirement reviews.
Third-party riskInformation sharing
Voluntary arrangements to share cyber threat information and intelligence within trusted communities of financial entities.
What it asks of you
- Participation in trusted sharing arrangements
- Rules for protecting shared information
- Use of intelligence in defences
How Cybergen helps
Cyber threat intelligence services that turn shared and external intelligence into action.
Cyber threat intelligenceKnow every ICT arrangement you depend on
DORA requires financial entities to keep a register of information covering all contractual arrangements for ICT services. We help you identify arrangements, assess which support critical or important functions and keep the register accurate.
Testing that rises with your risk
Supplying financial services? Be DORA-ready.
Financial entities must include specific provisions in ICT contracts and assess their providers. If you supply technology to the financial sector, you will be asked to prove your resilience.
- Answer DORA due diligence questionnaires with confidence
- Understand the contract provisions your customers need
- Evidence incident management, testing and continuity
- Support customer audits and exit planning
DORA services, clearly scoped
DORA gap assessment
Identify what is in place and what needs attention across all five pillars.
ICT third-party risk review
Assess supplier governance, due diligence, contracts and evidence.
Register of information support
Identify and document relevant ICT arrangements and critical functions.
Incident response and resilience testing
Review and exercise processes, and deliver testing from vulnerability assessment to red teaming.
Supplier readiness
Help ICT providers respond to DORA questions and contractual requirements.
Ongoing remediation support
Help your teams deliver the agreed improvement plan.
When did DORA start to apply?
DORA has applied since 17 January 2025 to in-scope EU financial entities.
Does DORA apply to ICT providers?
ICT providers are affected through their financial customers' obligations and contract requirements. Critical ICT third-party providers can be designated for direct oversight by the European Supervisory Authorities.
What is threat-led penetration testing (TLPT)?
Advanced testing based on real threat intelligence that simulates the tactics of actual attackers against live production systems. DORA requires it at least every three years for entities identified by their competent authority.
What is the register of information?
A register that financial entities must maintain covering all their contractual arrangements for ICT services, including those supporting critical or important functions.
Does DORA apply to UK firms?
DORA is EU law. UK firms with EU-regulated entities, or that supply ICT services to EU financial entities, may be affected. The UK has its own operational resilience regime.
Strengthen your operational resilience.
Tell us whether you are a financial entity or an ICT provider, and where you are on your DORA journey.
Thanks, we've received your enquiry
A member of our team will be in touch shortly.