02 / Compliance and certification
DORA, for the systems that keep the money moving
We help financial entities test their ICT risk framework against the regulation, tighten incident handling and supplier oversight, and run the resilience testing that sits behind it.
Overview
What DORA asks of you
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, applies to a wide range of financial entities. It asks for an ICT risk management framework owned by the management body, classification and reporting of major ICT-related incidents, a programme of digital operational resilience testing, and control over the risk that comes from ICT third-party providers.
Unlike NIS2, DORA is a regulation and applies directly in every member state. The detail sits in technical standards and in the expectations of your competent authority, and proportionality matters: what a small firm owes is not what a large bank owes.
Black Fox is not a lawyer or a supervisor. Threat-led penetration testing (TLPT), required for some entities, follows its own framework with requirements on the testers and involvement of the authority. We do not present ourselves as a TLPT provider. We help with the testing and preparation around it.
Who it is for
Banks, payment and e-money institutions, investment firms, insurers, crypto-asset service providers and the other financial entities DORA lists. Also ICT providers who serve them and need to answer their questions, audits and contract clauses.
The work, from scoping to evidence.
What we do
ICT risk management gap assessment
A review of your framework against the regulation: governance, identification of ICT assets and functions, protection, detection, response and recovery, and learning from incidents.
Incident management and reporting
A process to detect, classify and report major ICT-related incidents, with clear owners and a decision path your people can follow under pressure.
Resilience testing
Testing that fits your size and risk, such as vulnerability assessments, network and application penetration tests, scenario-based tests and source code reviews, with findings tracked to closure.
ICT third-party risk
Support with your register of contractual arrangements, supplier assessments, contract terms and exit plans for providers that support critical or important functions.
Business continuity
ICT business continuity and recovery plans that are tested, not just written, and that match what your critical functions really depend on.
Management body
Training and briefings so the management body can define, approve and oversee the framework it is responsible for.
How the engagement runs
Kickoff
We agree the scope, the entities and the people involved, and sign an NDA first if you need one.
Mapping
We map your critical or important functions, the ICT systems behind them and the providers that run them.
Gap assessment
Interviews, document review and technical sampling against the regulation, ending in a ranked gap report.
Implementation support
We work with your owners on the framework, the incident process, supplier oversight and continuity plans.
Testing
Resilience tests agreed in advance, with business and technical reports and proofs of concept for every finding.
Handover and follow-up
Recommendations and a remediation plan, then optional retesting and periodic reviews as the programme matures.
What you receive
- Gap assessment against the DORA requirements
- Prioritised remediation plan
- Incident classification and reporting procedure
- Input for your register of information on ICT providers
- Resilience testing reports with proofs of concept
- Management body training material
Black Fox prepares and supports you, and does not issue certificates, attestation reports or official assessments itself. Where a certificate or report is the goal, we coordinate the audit with our long-standing certification partners or a body of your choice, so the work runs end to end in one engagement.
Questions
Do you perform TLPT?
No. Threat-led penetration testing under DORA applies to entities identified by the authorities and follows a framework with specific requirements on the testers and on how the test is run. We help with the work around it, such as preparation, other resilience testing and remediation of findings.
How is DORA different from NIS2?
DORA is a regulation specific to the financial sector and applies directly across the EU. NIS2 is a directive covering many sectors and applies through national law. For financial entities in scope of DORA, DORA takes the lead on ICT risk.
We use a cloud provider. Is that our problem or theirs?
Both. You remain responsible for the risk you outsource. DORA asks you to assess providers, put specific terms in contracts, keep a register of the arrangements and plan your exit. Certain critical providers are also overseen directly at EU level.
Does a penetration test make us DORA compliant?
No single test does. Testing is one part of the regulation, alongside risk management, incident reporting and third-party risk. A test gives you evidence and a list of things to fix.
Related services
- Offensive securityPenetration TestingPenetration testing by Black Fox Security: black, grey and white box tests against an agreed scope, business and technical reports, and a retest of your fixes.
- Governance and riskThird-party risk managementSupplier risk management from Black Fox Security: inventory, tiering, questionnaires, evidence review and contract clauses, aligned with NIS2 and DORA expectations.
- Governance and riskBusiness continuity and disaster recoveryBCP and DRP from Black Fox Security: business impact analysis, continuity and recovery plans, backup and restore testing and tabletop exercises that test the plan.
- Compliance and certificationNIS2NIS2 support from Black Fox Security: applicability check, gap assessment against the risk-management measures, incident reporting, supply chain and training.
Start with the functions that matter
Tell us what kind of entity you are and what you already have. We will show you where the regulation and your framework part ways.