DORA readiness

Who this service is for

For financial entities and relevant ICT service relationships preparing or improving operational arrangements under DORA.

Common challenges companies face

• ICT risk registers are disconnected from critical services, risk tolerances and management decisions.
• Supplier records do not consistently capture service dependencies, contractual requirements or exit arrangements.
• Incident escalation and classification are unclear across technical, legal and business teams.
• Resilience testing produces findings without tracked remediation or management follow-up.

Technical scope

• Review ICT risk governance, service and asset dependencies, control ownership and reporting.
• Examine incident detection, escalation, classification and reporting procedures.
• Assess resilience testing, continuity, backup recovery and follow-up of identified weaknesses.
• Review ICT third-party records, concentration concerns, contractual review inputs and exit planning.

How Poleis supports you

• Agree applicability and relevant regulatory technical requirements with compliance and legal advisers.
• Trace selected critical services through technology, suppliers and operational controls.
• Review evidence and prioritise improvements, coordinating contractual issues with legal owners.

What you receive

• DORA readiness assessment and ICT risk improvement roadmap.
• Third-party information gap register and evidence collection plan.
• Incident and resilience process recommendations with accountable actions.

Engagement scope

Poleis provides technical and governance consultancy. Legal applicability and contractual interpretation are confirmed with your legal advisers; testing scope and specialist activities are agreed separately.

Official guidance