Compliance · DORA for suppliers

Your clients are regulated. Now you are reviewed.

Since January 2025 DORA has required banks, insurers, payment and investment firms to manage the risk of every ICT supplier they rely on. That lands on you as their supplier: longer questionnaires, new contract clauses, audit rights and incident notification duties. We build the evidence pack that answers them once, properly, instead of starting over for every client.

What financial clients now ask for

Contract terms required by DORA article 30: service descriptions, data locations, security measures, incident assistance, audit and access rights, exit and termination support
Information for their register of ICT third-party arrangements, including your subcontractors for critical services
Proof of business continuity and tested recovery for the services they depend on
Incident notification fast enough for their 4-hour and 24-hour reporting clock
Participation in their testing, and for some, threat-led penetration testing

The pack

Security evidence packPolicies, risk assessment, access control, logging, vulnerability management and recent test results, organised against the questions financial clients actually send, with a pre-filled answer set for the common questionnaires.

Contract and register supportA DORA clause checklist for your legal team, your standard position on audit rights and exit, and the data your clients need for their register of information, including your subcontracting chain.

Continuity and incident readinessA business continuity and recovery plan for the services you sell to financial clients, a dated restore test, and an incident procedure that notifies clients early enough for their own regulatory deadlines.

Built on daily practice: we run security in a PCI DSS Level 1 payment environment and answer these reviews from the other side of the table. The pack reflects what a financial client's risk team will check, not only what the regulation says.

A client sent you a DORA questionnaire?

Send us the questionnaire or the contract addendum. We'll tell you which answers you can already prove and quote a fixed price for the rest.

Get in touch →