DORA compliance audit for an institution of national importance

Client and challenge

An institution of national importance operating in critical infrastructure and providing services to the financial sector. As a service provider to entities subject to DORA, it had to demonstrate the compliance of its own operational resilience — ahead of an external audit and questions from its financial-sector clients.

The challenge was scale: dozens of ICT systems, many third-party providers, scattered documentation and a confidentiality regime that restricted access to the environment. The client needed a partner who would run the audit from plan to report with a single team, without handing knowledge off between firms.

Audit scope

• ICT risk management (Art. 5–16) — governance framework, management body roles, policies, business continuity and recovery.
• ICT incident management (Art. 17–23) — classification, notification procedures, reporting deadlines.
• Digital operational resilience testing (Art. 24–27) — testing program, TLPT readiness.
• Third-party risk (Art. 28–30) — register of information, contractual clauses, provider concentration assessment.
• Information sharing (Art. 45) — arrangements for sharing cyber threat information.

Process

Outcome

The management board received a single document answering the question “where do we stand and what should we do first,” and the technical teams received a concrete task list. The client can now answer any financial client’s questionnaire with evidence rather than assurances. The register of ICT information and contractual clauses were standardized to the level required by Art. 28–30.

What’s next

After the audit, the client continued working with us in IT Security (resilience testing program) and Cloud Computing (maintaining the environment in line with DORA requirements). This is the typical path: the audit reveals the gaps, and the other two areas close and maintain them.