- Security & Compliance
DORA compliance – gap review, ongoing compliance and evidence for your supervisor
DORA has applied directly across the EU since 17 January 2025, with no transition period. In Poland, the KNF (Polish Financial Supervision Authority) has had inspection and sanctioning powers under national law since 7 August 2025. There is no implementation deadline to wait for: your supervisor, or the bank you provide services to, can ask about your register of information, your test results or your incident reporting process at any time.
Tenesys closes the gaps on the technical side and supports the reporting side: from your ICT risk management framework, through readiness for a major incident and resilience testing, to cloud exit strategies. Then we keep you compliant on an ongoing basis.
DORA applies to you in one of two ways
Directly, if you are a financial entity, or through your contracts, if you provide ICT services to financial entities. Either way, someone will check your compliance. The only difference is who.
You are a financial entity
A bank, payment or e-money institution, investment firm, fund management company, insurer, crypto-asset service provider or another supervised entity. Your supervisor checks your compliance. Smaller entities, including small payment institutions and small investment firms, are not exempt from DORA – they may only apply the simplified ICT risk management framework (Art. 16). They still report incidents within the same timeframes as everyone else. Operating a small payment institution in Poland (MIP)? Factor in the regulatory risk: a proposal to abolish this legal form is currently under way.
You provide ICT services to financial entities
Software, cloud, hosting, system maintenance, managed services. Only 19 providers designated as critical are under direct EU oversight. Everyone else receives DORA requirements through their contracts: service levels, audit rights, incident reporting, exit strategy and participation in the client’s testing. The bank or fintech checks your compliance before it signs or renews the contract.
Not in the financial sector?
Companies in sectors such as energy, transport, manufacturing or healthcare fall under NIS2 (in Poland, implemented by the KSC Act)
Where financial entities most often have DORA gaps
Most entities had their policies and procedures ready before January 2025. The gaps are usually where a document has to match what actually happens in the systems. And ultimate responsibility for ICT risk lies with the management body, not with IT or a provider.
The register of information doesn’t match the contracts
The register was built in a spreadsheet before the first submission to the supervisor and nobody has updated it since. Contracts with providers supporting critical or important functions lack the required clauses on audit, incidents and exit. The chain of subcontractors is unknown. Impact: the document supervisors usually ask for first doesn’t hold up.
Four hours to report – and the incident hits on Saturday night
The clock for the initial notification starts when the incident is classified as major. Without round-the-clock monitoring and someone authorised to classify incidents outside business hours, that deadline stays theoretical. Impact: a late notification and questions from your supervisor about why.
A business continuity plan nobody has tested
DORA requires testing of systems supporting critical or important functions at least once a year. In practice it ends with a vulnerability scan, and disaster recovery has never been rehearsed on production data. Impact: a continuity plan that fails at the first real outage.
Critical functions in one cloud, with no realistic exit strategy
DORA requires an exit strategy for ICT services supporting critical or important functions, and an assessment of concentration risk. The document describes a move to another provider that nobody has costed or tested. Impact: an exit strategy that can’t be carried out in the time it assumes.
Digital resilience is engineering, not just documentation
A law firm or compliance adviser will tell you what DORA requires. We’ll also make it happen in your systems and deliver the evidence your compliance team can show your supervisor.
1.
Technical evidence, not just policies
Configurations, test results, SOC logs and exercise reports. Your compliance team has something concrete to show your supervisor or your bank.
2.
We know the cloud from the inside
We are partners of AWS, Microsoft, Google Cloud and OVHcloud, so we base exit strategies and concentration risk assessments on architecture, not assumptions.
3.
A 24/7 SOC built around the reporting clock
Monitoring that detects an incident as it happens is a precondition for meeting the 4-hour deadline, not an extra.
2.
We run a certified ISMS ourselves
Tenesys is certified to ISO/IEC 27001:2022, so we also know the requirements placed on ICT providers from the provider’s side.
DORA compliance, from gap review to readiness for your supervisor’s questions
We don’t start from zero. We take what your compliance team, law firm or adviser has prepared and check whether it matches what actually happens in your systems. Then we close the gaps on the technical side.
DORA gap review
We compare your ICT risk management framework, register of information, incident procedures, testing programme and supplier contracts with the requirements of DORA and its technical standards (RTS/ITS). We take the simplified framework into account if it applies to you. After 2–4 weeks you get a report with gaps ranked by supervisory risk and a plan to close them.
ICT risk management framework
We update the framework so it describes your real infrastructure: asset inventory, dependencies between systems, a map of critical or important functions, backup and business continuity policies. The framework review, required at least once a year, becomes a process rather than an annual rush.
Register of information and ICT supplier contracts
We put your register of information in order so it passes validation when submitted to your supervisor and matches your contracts. On the technical side, we review the clauses on service levels, audit, incidents, subcontractors and exit, and your legal team gets a specific list of changes.
Readiness for a major ICT-related incident
We set the classification criteria, roles, deputies and the reporting path to your supervisor. Round-the-clock monitoring in our SOC means the 4-hour clock starts when the incident starts, not on Monday morning. We test the process in an exercise before a real incident happens.
Digital operational resilience testing
We design your testing programme and run it: vulnerability scanning, penetration testing, disaster recovery testing and scenario-based tests. If your supervisor designates you for TLPT, we prepare the scope, the systems and the team on your side.
Cloud resilience and exit strategies
We assess concentration risk with a single cloud provider and prepare exit strategies that can actually be executed, with costed timelines, budgets and a target architecture. Infrastructure as code also gives you evidence of how your environment is configured and that it can be rebuilt.
Providing IT to banks or fintechs? We’ll prepare you for their DORA requirements
A bank can’t pass its accountability on to you, so it passes on its requirements instead. A due diligence questionnaire, a DORA addendum to your contract, audit rights, an incident notification deadline counted in hours. If you can’t answer them convincingly, the contract goes to a provider who can.
- we prepare your answers to due diligence questionnaires and the evidence behind them: policies, test results, configurations
- we check whether you can technically meet the DORA addendum before you sign it
- we implement missing safeguards and a process for notifying your client of incidents
- we prepare an exit plan your client can include in its own exit strategy
- we provide a named contact for your client’s risk team, for example through CISO as a Service
Your path to DORA compliance you can sustain
Four stages. We start from what you already have, because DORA has applied since January 2025.
1.
Current-state review
See your gaps through your supervisor’s eyes. A free call sets the scope. The gap review (2–4 weeks) compares your documentation with what actually runs in your systems and shows what your supervisor or your bank would challenge first.
2.
Remediation plan
Get priorities you can defend to your board. A list of gaps ranked by supervisory and operational risk, with costs and a timeline. The board knows what we close first and why.
3.
Closing the gaps
Close the gaps in your systems, not just in your documents. We implement missing safeguards, clean up the register, set up the incident process and run the tests. We collect evidence as we go, in a form ready for your supervisor.
4.
Maintenance
Stay compliant in the cycle DORA sets. Through our CISO as a Service, we run the annual framework review, the testing programme, register updates and reporting to the board.
DORA is a cycle, not a project
The regulation has no end date. Some obligations come back every year, some with every change in the company, and an incident can happen at any time.
- review of the ICT risk management framework at least once a year and after every major incident
- testing of systems supporting critical or important functions at least once a year
- updates to the register of information and its periodic submission to your supervisor
- regular ICT risk training for the management body and staff
- oversight of providers, contracts and exit strategies
- TLPT at least every 3 years, if your supervisor has designated you
Hiring an experienced CISO costs EUR 8,000–15,000 a month, plus months of recruitment, and a smaller financial entity often doesn’t need one full-time. With CISO as a Service, you get that expertise in a scope that fits the scale of your business. Our CISO knows your environment because they closed the gaps in it. They report to the board in the language of risk, work with your compliance team and have Tenesys engineers and our 24/7 SOC behind them.
The management body of a financial entity bears ultimate responsibility for ICT risk (Art. 5(2)), and that responsibility cannot be passed on to a provider. A virtual CISO gives the board what it needs for real oversight: regular reports, recommended decisions and documentation it can show to the supervisor.
Frequently asked questions about DORA compliance
A law firm or compliance adviser interprets the requirements and prepares the documentation; we also implement them in your systems. We clean up the register of information, set up 24/7 monitoring, run the tests, prepare cloud exit strategies and collect technical evidence. In most cases we work alongside your compliance team or law firm, not instead of them.
We’ll check whether your documentation matches what runs in your systems, and close the differences. They usually concern a register of information that doesn’t match the contracts, incident reporting outside business hours, recovery testing and exit strategies that nobody has tested. Your documentation stays; we add the evidence behind it.
A gap review usually takes 2–4 weeks, and its cost depends on the number of systems, providers and critical or important functions. We agree the scope and the quote after a free 60-minute call. The review report includes the cost and timeline for closing each gap, so the board approves specific amounts.
Yes, indirectly, through your contracts with clients. Only ICT providers designated as critical are directly supervised, but every bank and fintech has to write requirements on service levels, audit, incident reporting and exit into its contract with you. We’ll help you meet them and document them before your client asks.
We prepare you for it, but we don’t carry out TLPT ourselves. TLPT is performed by external testers who meet specific requirements, in coordination with the supervisor. We help define the scope and systems, prepare the environment and your team, and close the gaps found after the test. Day to day, we run penetration tests and recovery tests, which are part of the mandatory testing programme.
