%20(18).png)
Are you a financial company or an ICT service provider that needs to demonstrably fulfill the requirements of Regulation (EU) 2022/2554 on digital operational resilience?
DORA has been directly applicable since January 17, 2025. Regulators, management, and customers expect documented ICT risk management, regulated reporting processes, regular resilience tests, and robust management of ICT third-party risks.
Certinova guides you efficiently through the entire process: from the impact assessment and gap analysis to implementation and effectiveness testing. Where available, we build upon your existing ISO 27001 ISMS. Upon request, we can also take over the internal audit for your DORA requirements, either as an outsourcing or co-sourcing arrangement.
Establish the foundation that will withstand a regulatory audit now.
Digital workflows and reusable evidence reduce manual effort – especially during re-certification.
Numerous completed audit and assessment projects form the basis of our methodology.
SaaS providers, cloud platforms, IT service providers, and regulated companies rely on Certinova
Regardless of where you are starting from, we provide the right service for your current level of maturity—without detours and without overhead.
We clarify whether you fall under DORA as a financial company or an ICT third-party service provider, which proportionality rules apply to you, and which functions and services are in scope. You will receive a reasoned, documented assessment.
.svg)
We evaluate your measures against the five pillars of DORA: ICT risk management, incident management and reporting, digital resilience testing, management of ICT third-party risks, and information sharing. We identify gaps and prioritize measures in an actionable roadmap.
.svg)
We support you with your framework, reporting process, information register, contract adjustments with ICT service providers, and testing program. You retain responsibility, while we ensure structure and momentum.
.svg)
We independently assess whether your measures are appropriate and effective, and document the results in a way that stands up to scrutiny from regulators, management, and customers. For ICT service providers, we create evidence that your regulated clients can use for their third-party governance.
We combine professional assessment by experienced auditors with technology-driven processes.
The result: shorter audit cycles, less internal effort for you, and reports that meet your customers' requirements.
Evidence is collected in a structured manner and automatically validated – the professional assessment remains with our auditors.
Submit documents, answer questionnaires, track status—transparent instead of endless email chains.
A clear audit pattern from scope to report—fewer follow-up questions, predictable effort.
An experienced team supports you beyond the individual report—including follow-up audits and related frameworks.
From scope of application and management responsibilities to the distinction between NIS2 and ISO 27001: You will find the most important answers here.
Can't find your question? Please contact us directly.
Yes. We conduct a risk-based audit of your ICT risk management framework, incident management, resilience testing, and ICT third-party management, and report our findings to your management and supervisory board. We offer full outsourcing of the audit function or co-sourcing for specialized topics. To maintain independence, we separate our audit and consulting mandates at the personnel level.
DORA applies to a wide range of financial companies, such as banks, insurers, investment firms, payment and e-money institutions, and other entities in the financial sector. Additionally, it affects ICT third-party service providers that supply these companies, indirectly through contractual and documentation requirements. We will clarify this in a documented impact assessment.
No. DORA is a binding regulation, not a certifiable standard. However, you can demonstrate compliance through independent audits and reports, such as ISO 27001, SOC 2, or an assessment of your DORA measures. We will determine which format is right for you during the scoping phase.
Financial companies must manage their ICT service providers both contractually and operationally, including maintaining an information register, audit rights, and exit strategies. Service providers that provide verified evidence respond to customer inquiries faster and avoid repeated individual audits.
Let's get in touch to discuss your requirements.
