Cloud and security · Banking
DORA ICT risk and resilience engineering
We provide DORA ICT risk and resilience engineering for financial entities and their ICT providers: an ICT risk management framework implemented in tooling, incident classification and reporting workflows, digital operational resilience testing including threat-led penetration testing, a register of ICT third-party arrangements and the evidence supervisors expect. DORA's requirements become engineering work with owners and dates, and you own the controls and the code.
Checklist · Cloud and resilience
Cloud migration and resilience checklist for regulated firms
A checklist for regulated firms planning a cloud migration, a resilience programme or a security uplift: workload assessment, landing zone, data residency, resilience, security, delivery, third-party risk and evidence.- 01Eight areas that supervisors and auditors ask about, with testable checks.
- 02Resilience and recovery items that are easy to leave untested.
- 03Third-party, exit and data residency questions for the board.
- 04Seven questions to put to any vendor or engineering partner.
Free download
Get it on screen in a few seconds.
What the system does, module by module.
- 01
ICT asset and dependency inventory
An inventory of ICT assets, services, data and dependencies, mapped to critical and important functions, kept current from the configuration and cloud estate. - 02
ICT risk management framework
Risk identification, assessment and treatment for ICT, with policies, owners, controls, metrics and reporting to the management body. - 03
Protection and prevention controls
Access control, encryption, network security, patch and change management and secure development, implemented and evidenced as engineering controls. - 04
Detection and monitoring
Logging and anomaly detection across the estate, with alerting thresholds and response triggers that match the incident classification scheme. - 05
Incident management and reporting
Classification of incidents against the regulation's criteria, and workflows that produce initial, intermediate and final reports to the supervisor within the required times. - 06
Business continuity and recovery
Continuity and recovery plans for critical functions, backup and restoration, recovery objectives and the evidence of testing. - 07
Resilience testing programme
Vulnerability assessment, scenario and performance testing, and for significant entities, threat-led penetration testing planned and managed to the requirements. - 08
ICT third-party risk management
A register of information on ICT service arrangements, due diligence, the contractual provisions the regulation requires, monitoring and exit strategies. - 09
Information sharing and reporting
Participation in cyber threat information sharing, board reporting and the evidence pack for supervisory reviews.
Reference architecture.
Standards and interfaces
What we design against.
- Regulation (EU) 2022/2554 (DORA)
- The Digital Operational Resilience Act, in application for EU financial entities since January 2025, covering ICT risk, incident reporting, testing, third-party risk and information sharing.
- DORA technical standards
- Regulatory and implementing technical standards on the risk framework, incident classification and reporting, testing, and the register of information.
- TIBER-EU and threat-led testing frameworks
- Frameworks for threat intelligence-based ethical red teaming that threat-led penetration testing follows.
- ISO/IEC 27001, ISO 22301 and NIST CSF
- Security, continuity and cybersecurity frameworks that structure controls and evidence.
- EBA and other supervisory guidelines
- Guidelines on ICT and security risk, outsourcing and related topics that continue to inform supervisory practice.
- Contract clauses for ICT providers
- The required provisions on service levels, data, audit, subcontracting, security and exit.
Data model
The core entities.
- Function and ICT service
- Critical or important function, supporting systems, providers and recovery objectives.
- ICT risk and control
- Risk, control, owner, effectiveness, test evidence and residual risk.
- Incident
- Classification criteria, timeline, impact, reports submitted and lessons.
- Test and finding
- Test type, scope, date, results, findings and remediation.
- ICT third-party arrangement
- Provider, service, functions supported, contract terms, subcontractors and exit plan.
- Continuity plan
- Scenario, procedures, owners, last test and outcome.
- Management report
- Period, metrics, decisions and approvals by the management body.
When custom development is the right call.
Controls designed in, not added later.
Management accountability
The management body approves and reviews the framework, and the system records its decisions and reports.Evidence integrity
Control evidence, test results and incident records are retained unaltered with timestamps for supervisory review.Segregation of functions
Risk ownership, control operation and assurance are held by separate roles.Supplier access control
ICT providers have limited, logged and revocable access, with their obligations enforced through contracts and monitoring.Tested response
Incident and recovery procedures are exercised, and findings are tracked to closure.
From discovery to a system you run.
- 01
Applicability and gap assessment
We confirm which parts of DORA apply to the entity, and compare practices with the requirements and technical standards. - 02
Inventory and register
The ICT asset and dependency map and the third-party register are built from authoritative sources. - 03
Controls, incident workflow and testing plan
Controls are implemented and evidenced, incident classification and reporting are automated and a testing programme is planned. - 04
Third-party contracts and exit
Provider contracts are reviewed against the required provisions, and exit plans are prepared and tested. - 05
Operate and report
The framework runs, with reporting to management and supervisors and continuous improvement from tests and incidents.
Relevant work
Where to see our work.
Common questions.
- Does DORA apply to us?
- It applies to most EU financial entities and, through contracts and designation, to many of their ICT providers. Entities outside the EU that serve EU clients should check how it reaches them. We help establish the position and the work involved.
- What does threat-led penetration testing involve?
- Realistic attack simulations based on threat intelligence against live production systems that support critical functions, carried out by accredited testers under supervisory frameworks. We plan the programme and the remediation, and the testing itself is done by qualified testers.
- What is the register of information?
- A structured register of all ICT third-party arrangements, with the functions they support and key contractual details, which entities must maintain and submit to supervisors.
- Can this be automated?
- Much of it can. Asset inventory, control evidence, incident timelines and register data can be drawn from the cloud, configuration and ticketing systems, so compliance work is reduced to review and decision.
- Who owns the platform and code?
- You do. The code, the controls and the data stay yours.