DORA advisory
We confirm how DORA reaches you, assess your ICT risk management and third-party arrangements against it, and plan the work to close what is missing.
For EU financial entities that DORA regulates directly, and for the ICT providers whose contracts with them carry DORA requirements. Mapped to your ISO 27001 controls where you already run an ISMS.
Independent consulting practice · Not a supervisor or law firm · Fixed scope, written proposal
Who it is for
What we assess
What you receive
We do not give legal conclusions or promise regulatory approval; where legal interpretation is needed it comes from your counsel.
The service
We establish how DORA reaches you - as a regulated financial entity, as an ICT provider under contract, or both - then assess the specific obligations that apply and plan the work to close the gaps. This is regulatory readiness work, not generic security consulting, and it does not replace legal advice from your counsel.
EU financial entities (Article 2)
Credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, insurers, fund managers and the other entity types DORA lists. For them DORA is binding regulation, supervised by their competent authority.
ICT third-party service providers
Software, cloud, data, managed service and outsourcing providers to financial entities. DORA reaches them mainly through the contract terms their clients must impose under Articles 28 to 30; only providers designated as critical are overseen directly.
Groups and firms outside the EU
Groups with several licensed entities, firms in Norway (where DORA applies through national law) and firms in Switzerland or elsewhere that serve EU financial entities and inherit DORA through contracts or EU subsidiaries.
Entity type and licence
Is the entity one of the Article 2 financial entity types, and which competent authority supervises it? For a group, which entities are in scope.
Proportionality
Whether the simplified ICT risk management framework (Article 16) applies, and how size, risk profile and services set the depth of the work.
ICT third-party position
For providers: which clients are financial entities, which services support critical or important functions, and what their contracts require.
Critical provider designation
Whether the provider is among the critical ICT third-party providers designated by the European Supervisory Authorities, which brings direct oversight.
Jurisdiction
EU Member State, EEA (Norway: national DORA Act) or third country - and therefore which rules and which supervisor apply.
DORA is an EU regulation and applies directly in every Member State, but supervision sits with national competent authorities, whose expectations and reporting channels differ. In Norway it applies through the national DORA Act. It is not Swiss law: Swiss firms meet it through EU clients' contracts or EU entities, alongside FINMA's own operational resilience expectations.
Last verified 16 October 2026 against EUR-Lex - Regulation (EU) 2022/2554 and European Commission - Digital operational resilience.
What Kellwick delivers
One control set, one evidence base, one roadmap - so DORA reinforces your ISO 27001 programme instead of duplicating it.
Applicability and scope assessment
Whether you are a financial entity under Article 2, an ICT third-party provider reached through contracts, or both - and, for a group, which entities are in scope and under which competent authority.
ICT risk management gap assessment
Your ICT risk management framework against Chapter II, mapped to your existing ISO 27001 controls where you have them, so you see where certified stops and DORA begins.
ICT third-party risk governance
Third-party risk strategy and policy, pre-contract assessment, concentration risk and the monitoring a supervisor expects to see evidenced.
Contract and supplier control assessment
Your ICT contracts against the Article 28-30 requirements - audit and access rights, incident assistance, service levels, exit and termination - and a plan for renegotiation where they fall short.
Register of information support
Building or cleaning up the register of ICT third-party arrangements in the structure the technical standards require, and a process to keep it current for each annual submission.
Incident management and reporting readiness
Classification against the DORA criteria, reporting workflow and templates, and a tabletop of the process - so the first notification is not drafted for the first time during a real incident.
Resilience testing governance
Where your testing programme sits - from vulnerability assessments to scenario-based tests - and, for entities identified for threat-led penetration testing, governance aligned to Delegated Regulation (EU) 2025/1190. We govern the programme; specialist testers perform the tests.
Remediation planning
A sequenced roadmap: what to close first, who owns it, the effort involved and the supervisory exposure if it slips.
Ongoing governance
Continued coordination after the gap is closed, through a Fractional GRC Lead or a vCISO retainer with a defined monthly capacity.
How this typically works
You do not have to buy the whole journey up front. Start with the assessment; each step earns the next.
Whether and how DORA applies to you, then current state against the obligations that do: findings, owners, priorities and a remediation roadmap.
Policies, ICT risk framework, incident classification process, contract terms and evidence - designed with your owners, who keep running them.
A complete, defensible register of ICT third-party arrangements, and the governance that keeps it current for each annual submission.
A Fractional GRC Lead or a vCISO keeps the obligations operating once the gaps are closed - within an agreed monthly capacity.
Fractional GRC Lead →Detailed guide
How DORA relates to ISO 27001, how it reaches ICT suppliers, and what its five pillars ask in practice. General information, not legal advice.
The problem
DORA has applied since 17 January 2025 to the financial entities listed in Article 2. For those firms it is binding regulation, supervised by the competent authority as part of the licence. In Norway it applies through the national DORA Act; in Switzerland it is not domestic law at all.
Last verified 16 October 2026 against EUR-Lex - Regulation (EU) 2022/2554 and European Commission - Digital operational resilience.
ISO 27001 is a genuine foundation. It gives your firm a governed ISMS, a risk process and a control set that map onto much of what DORA expects. But ISO 27001 is a voluntary standard, and DORA is binding regulation. The distance between the two - incident reporting on the regulator's timeline, a prescribed ICT third-party register, mandatory resilience testing, board-level oversight - is precisely the ground a supervisor probes first. Certified is a head start. It is not the finish line.
Coming from the ISO side? Start with an ISO 27001 readiness assessment and build DORA on top of it.
Supplying a regulated client?
Financial entities must manage ICT third-party risk and put specific terms into their ICT contracts. If you build, host or run software for a bank, payment institution, insurer or investment firm, those terms arrive as clauses and questionnaires - and you are expected to evidence them.
ISO 27001 answers most of what a client asks to see. We map your client's DORA clauses onto your controls and close what is left - so the next due-diligence request is answered from evidence.
Direct oversight is the exception: only ICT providers designated as critical by the European Supervisory Authorities are overseen under DORA itself. For everyone else the obligation is your client's, and it reaches you through the contract.
The five DORA pillars
Five pillars carry most of the obligation. Each one is somewhere your ISMS either already helps - or leaves a gap a supervisor can see.
A governed framework for identifying, protecting, detecting and recovering ICT systems - board-owned, documented and tested, not just an IT checklist.
Classifying ICT-related incidents and reporting major ones to your regulator inside strict timelines. ISO 27001 asks you to manage incidents; DORA dictates when and how you report them.
A programme of resilience testing - from vulnerability assessments to scenario-based tests - proving you can keep operating through disruption, not just that controls exist on paper.
A register of ICT providers with contractual, monitoring and exit requirements. Your PSPs, cloud, liquidity and platform vendors are in scope - concentration risk included.
Where you take part in threat-intelligence sharing, the governance and safeguards around it are in place and documented - not improvised.
What it costs
Scope first, then the gap. Both are supervised rather than certified, so the work ends in evidence you can put in front of a regulator, not a certificate.
Scoped on a call
Where you stand against DORA's five pillars, with the evidence a supervisor asks for - ICT risk, incident reporting, the Register of Information, resilience testing and third-party risk.
What changes the price: Entity type · Scale · Existing ISMS
Scoped on a call
Find out whether NIS2 even applies to you before building anything - the two-gate scope test worked through and put in writing.
What changes the price: Entity and ownership structure · Sector · Number of services
The cheapest possible answer to the most expensive NIS2 question - do the obligations reach you at all.
Every engagement is fixed-scope and fixed-price before it starts. Prices exclude taxes, certification-body fees, travel and third-party services, and are set on a short scoping call. All pricing.
ISO 27001 vs DORA
Same territory, different force. This is the difference a regulated firm actually needs to plan around.
| Area | ISO 27001 | DORA |
|---|---|---|
| Nature | Voluntary certification against a standard. | Binding EU regulation for financial entities. |
| Incident reporting | Manage and learn from incidents. | Classify and report major ICT incidents to the regulator within set deadlines. |
| Resilience testing | Recommended; scope is yours to define. | Mandatory testing programme, with threat-led testing for significant entities. |
| Third-party risk | Supplier controls in Annex A. | Prescribed ICT third-party register, contract terms, monitoring and exit plans. |
| Enforcement | Certificate withdrawn by the certification body. | Supervisory action by your competent authority - a licence matter. |
Sector-specific guidance: DORA for fintech and payments and DORA for investment firms and brokers.
DORA + ISO self-check
Answer honestly. This is an indicative signal, not a formal gap analysis - but it will tell you fast whether your ISO 27001 programme has left DORA gaps a competent authority would expect your firm to have closed.
Want the maintenance side handled continuously? Fractional GRC Lead or vCISO.
DORA questions, answered
Applicability first, then the gap - mapped against your ISO 27001 ISMS where you run one, with a prioritised roadmap. Scope and price in a written proposal.
Certification is issued by accredited certification bodies; DORA and NIS2 supervision is performed by competent authorities. Kellwick prepares you for these processes; it does not perform them and cannot guarantee their outcome.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.