DORA Sprint

A fixed-scope, rapid assessment of your readiness against DORA's requirements. You get a gap analysis against the regulation, a prioritised remediation plan, and a clear, practical path to compliance — without a lengthy, open-ended engagement.

What to expect:

• Mobilisation — scope confirmed and evidence request list issued

• Discovery — document review and stakeholder interviews across your risk, incident, testing and third-party functions

• Gap assessment — findings mapped and RAG-rated against all five DORA pillars

• Roadmap & reporting — prioritised remediation roadmap and full assessment report

• Close-out — review cycle and executive readout

Typical duration: 3–4 weeks.

What DORA requires:

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) sets out five areas of obligation for in-scope financial entities. A DORA Sprint assesses your readiness against all five, article by article:

• ICT risk management (Chapter II, Articles 5-16) - governance, the risk management framework, and the identify/protect/detect/respond/recover controls around it

• ICT-related incident management, classification and reporting (Chapter III, Articles 17-23) - your incident process, how you classify a major incident, and reporting it to your regulator in time

• Digital operational resilience testing (Chapter IV, Articles 24-27) - from basic testing of ICT tools through to threat-led penetration testing (TLPT), where you’re in scope for it

• ICT third-party risk management (Chapter V, Articles 28-44) - your ICT provider register, concentration risk, and the specific contractual provisions DORA requires with critical providers

• Information-sharing arrangements (Chapter VI, Article 45) - participation in cyber threat intelligence sharing, where relevant

Is this for you?

DORA applies directly to 21 categories of “financial entity” defined in Article 2 - among them credit institutions, payment and e-money institutions, investment firms, fund and asset managers, insurers and reinsurers, insurance intermediaries, crypto-asset service providers, and trading venues - plus their critical ICT third-party providers. In practice, that most often means:

• Banks, building societies and specialist lenders

• Insurers, reinsurers and MGAs

• Payment institutions and e-money firms

• Asset and investment managers

• ICT providers a regulated financial entity depends on (cloud, core banking platforms, payments infrastructure)

A note for UK-based firms, since this comes up on almost every first call: DORA is EU law, so it doesn’t apply directly to a purely UK-regulated entity. It becomes relevant where the firm (or its group) operates in the EU, or where it’s a critical ICT provider to EU financial-sector clients who are now contractually required to push DORA’s third-party provisions down the supply chain. The UK also runs its own parallel operational resilience regime (the FCA/PRA rules), covering much of the same ground - so a UK-only firm without EU exposure is a candidate for a readiness assessment against the UK regime rather than DORA itself, but the method and most of the findings translate directly either way. Worth raising on the discovery call if you’re not sure which applies to you.

Frequently asked questions

How long does a DORA Sprint take?

Around 3-4 calendar weeks from kickoff to executive readout - client-side interview scheduling and a review cycle are usually the pace-setters, not the assessment itself.

Does DORA apply to us if we’re UK-only?

See the note above - short answer, not directly unless you or your group operate in the EU or supply critical ICT services to EU financial entities, but the UK’s own operational resilience rules cover similar ground and a readiness assessment maps across cleanly either way.

What’s actually in the gap analysis?

A RAG-rated gap register, mapped article-by-article against all five areas above, with the root cause behind each gap - not just a pass/fail - plus a prioritised remediation roadmap sequenced by regulatory risk and effort, and an executive summary deck for your board or leadership team.

Do we need threat-led penetration testing (TLPT)?

Only a subset of entities - designated by their regulator, generally larger or more systemically important firms - are required to run TLPT under Articles 26-27. Most firms aren’t in scope for it, but should still know whether they are; establishing that is part of the Sprint’s testing-pillar assessment, not an assumption either way.

Can you review our contracts with critical ICT suppliers?

Yes - the third-party pillar of the Sprint checks your key contracts against DORA’s required provisions (audit rights, exit assistance, sub-outsourcing notification, under Articles 28-30). A deeper, supplier-by-supplier contract and concentration-risk review is covered by the standalone Third-Party, Supplier & Cloud Risk service.

What happens if we don’t comply?

DORA requires each EU member state to set effective, proportionate and dissuasive administrative penalties and remedial measures (Article 50) - the actual monetary amounts are set at member-state level, not a fixed EU-wide percentage, and can include cease-and-desist orders, restrictions on practices, and public notice of the breach. The reputational and supervisory exposure tends to matter as much as the fine itself for a firm relying on financial-sector trust.