Sector-Specific Compliance
DORA (Financial Sector)
ICT risk assessment, third-party provider risk, resilience testing, incident reporting.
1 services · Fixed price · 14-day warranty · Senior engineers only
Frequently Asked Questions
What makes an ICT provider 'critical' under DORA?+
DORA considers: impact on service continuity if provider fails, difficulty of substitution, data sensitivity, and geographic concentration. Cloud infrastructure providers are almost always critical.
What does DORA require in ICT contracts?+
Article 30 specifies mandatory contractual provisions: SLAs, data location requirements, audit rights, breach notification timelines, exit strategies, and sub-outsourcing restrictions. We gap-check your existing contracts.
What is sub-outsourcing risk?+
When your ICT provider outsources to their own providers. Example: you use a fintech SaaS that runs on AWS — AWS is a sub-outsourcing dependency. DORA requires transparency into these chains.
How does this differ from Vendor Risk Assessment (CR-SOC-07)?+
CR-SOC-07 covers general vendor risk for SOC 2. This service adds DORA-specific requirements: critical provider classification, DORA Article 30 contractual review, concentration risk, and sub-outsourcing analysis specific to financial regulation.
Can we combine with Supply Chain Audit (CR-NIS2-07)?+
Yes. CR-NIS2-07 covers software supply chain and NIS2 requirements. This service adds DORA's financial-sector requirements. If subject to both, we recommend doing them together.
$5
Not Sure Where to Start?
Our IT Health Check finds every compliance gap in your infrastructure. 1 business day. You get a prioritized list of what to fix.
Not sure which service you need?