Understand where your digital operational resilience arrangements need attention. Simbix LLP assesses gaps in ICT risk management and helps financial entities prioritise improvements to support ongoing DORA compliance.
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, entered into force on 16 January 2023 and has applied since 17 January 2025. The focus is now on maintaining effective controls, addressing gaps and keeping evidence of how resilience arrangements operate.
Discuss a DORA assessmentOur DORA assessments are for financial entities within the regulation’s scope, including relevant banks, insurers and investment firms, subject to the applicable exclusions and proportionality provisions. The engagement should reflect the entity, its activities and its regulatory obligations.
For UK organisations, the starting point is to establish the connection to DORA. UK status alone does not make a firm directly subject to the regulation. EU-regulated entities within a group may be in scope, while UK ICT suppliers may face contractual and assurance requests from EU financial customers. Designated critical ICT third-party providers are subject to a separate EU oversight framework.
Review the framework for identifying and managing technology risk, including asset information, protection and detection controls, and continuity arrangements.
Assess the arrangements for classifying incidents, escalating decisions and supporting required reporting. Identify gaps in responsibilities, procedures and supporting evidence.
Review the testing approach and how findings feed into remediation. Consider the relevant requirements and whether advanced threat-led penetration testing obligations apply.
Assess supplier governance, contractual arrangements, concentration risk, monitoring and exit planning, including the information needed to support oversight of ICT dependencies.
Review relevant arrangements for sharing cyber threat information, where used. DORA permits voluntary participation in qualifying information-sharing arrangements; participation is not a blanket requirement for every entity.
Identify the entities, services and ICT arrangements to be reviewed, the assessment criteria and any scope questions requiring legal advice.
Assess relevant policies, control records and supporting documentation with the responsible teams. Record gaps and areas where the evidence is incomplete.
Explain the findings and identify actions for management to consider, taking account of risk, dependencies and the applicable requirements.
Agree what further support is needed and how management will track actions and evidence improvements.
The outputs are agreed before work begins and can include:
A DORA assessment supports your compliance programme; it does not certify compliance or guarantee a supervisory outcome. Management remains responsible for meeting the applicable obligations. Legal interpretation, contract drafting, regulatory submissions and technical testing are not assumed to be included in an assessment and require an explicitly agreed scope and appropriate expertise.
DORA has applied since 17 January 2025. An assessment can help identify remaining gaps, evaluate changes and prioritise ongoing remediation.
No. Applicability depends on the legal entity and its activities, not simply a UK presence. UK firms should distinguish obligations of any in-scope EU entities from customer contracts and separate UK regulatory requirements.
No. Advanced TLPT obligations apply to financial entities identified under the relevant criteria and supervisory process. A standard penetration test should not be presented as satisfying DORA TLPT requirements.
Relevant policies, controls and testing evidence can inform the assessment. They still need to be assessed against the applicable DORA requirements; another framework does not automatically establish DORA compliance.
