Gap assessment
Assess current arrangements against DORA or NIS2 requirements and prioritise the gaps by risk.
Services · Governance, Risk & Regulatory
DORA, NIS2 & Third-Party Risk
Regulatory readiness that improves resilience, not just paperwork.
Arrange a meetingWhy it matters
The EU Digital Operational Resilience Act (DORA) and the NIS2 Directive place clear responsibilities on management bodies for ICT risk, incident reporting, resilience testing and third-party oversight. Our focus is regulated financial institutions: clarifying applicable obligations, assessing critical ICT dependencies and building evidence that holds up under supervisory scrutiny. NIS2 is considered where relevant, without assuming it applies in the same way as DORA.
Questions this engagement answers
- 01Which of our services and suppliers are critical, and can we evidence why?
- 02Is our register of ICT third-party arrangements complete and accurate?
- 03Could we meet incident classification and reporting timescales?
- 04Do our contracts give us the rights we need, including exit?
What the engagement can include
Third-party risk
Identify critical ICT suppliers, review due diligence, contracts, concentration risk and exit plans.
Incident & testing
Align incident classification, reporting and resilience testing with regulatory expectations.
Management body
Briefings and governance support so the board can discharge its responsibilities.
How we work
- 1
Scope
Confirm which regulations apply and which services and suppliers are in focus.
- 2
Assess
Review policies, registers, contracts and evidence against the requirements.
- 3
Remediate
Agree a realistic plan, focused first on critical services and suppliers.
- 4
Evidence
Help build the records and reporting that demonstrate compliance and resilience.
What you receive
- Gap assessment and prioritised remediation plan
- Critical supplier and dependency mapping
- Evidence-led third-party risk framework, including focused information requests
- Board briefing on obligations and progress
Illustrative scenario
A critical supplier hidden behind a small contract
A firm's register lists a low-value software supplier as non-critical. Mapping the payment process shows the supplier hosts a component without which payments cannot be released. The contract has no audit rights and no exit plan. Re-classifying the supplier, agreeing contractual improvements and testing a workaround turns a hidden concentration risk into a managed one.
Buck's view
“Contract value is a poor guide to criticality. Regulators expect firms to understand their dependencies through the services they support, and to prove they could cope if a supplier failed.”
Professor Buck Rogers, Poro Advisory