Individual Consulting on ICT Risk Management under DORA

Our services may include:

• assessing whether DORA applies to your organisation and determining the applicable ICT risk management framework
• establishing an appropriate governance and role structure
• developing the digital operational resilience strategy
• preparing policies, guidelines and process descriptions
• identifying and classifying information and ICT assets
• mapping ICT assets to business processes and functions
• developing a methodology for identifying and assessing ICT risks
• defining risk tolerances, indicators and reporting channels

• establishing ICT incident management, including classification and notification procedures
• developing ICT business continuity, response and recovery plans
• planning and documenting digital operational resilience tests
• establishing ICT third-party risk management
• supporting the register of information, contract reviews and exit strategies
• preparing management reports and decision-making documents

DORA and the supplementary Regulatory Technical Standards specify the required methods, processes, policies and control mechanisms in greater detail. These include, for example, ICT asset management, information security, encryption, network security, ICT project management and physical security measures.