Does DORA apply only to banks?

No. DORA applies to a broad range of financial entities, not only banks. It also has important indirect effects on ICT third-party providers such as cloud, SaaS, cybersecurity, data, and technology companies that serve regulated financial customers. The exact relevance depends on your role, services, customers, and contracts.

We are a SaaS provider, not a financial entity. Why are customers asking about DORA?

Financial entities need stronger oversight of the ICT services they depend on. If your product or service supports their important operations, customers may ask about your security, resilience, incident management, suppliers, data location, continuity, and contractual commitments. We can help you understand and respond to those expectations.

Is DORA the same as ISO 27001?

No. ISO 27001 provides a general information-security management-system framework. DORA focuses specifically on digital operational resilience in the financial sector, including ICT risk, incident management, resilience testing, and third-party risk. A mature ISO 27001 programme can provide useful foundations, but it does not automatically cover every DORA expectation.

Can you help us respond to a DORA questionnaire or contract addendum?

Yes. We can help review requirements, identify relevant evidence, clarify gaps, prepare accurate responses, and create a pragmatic improvement plan. Legal interpretation of specific contractual clauses may require your legal counsel, but we can support the security, privacy, operational, and technical substance.

What should we do first?

Start by clarifying your role, important services, customer requirements, critical systems, data, suppliers, and current resilience practices. A focused assessment can then identify the highest-priority improvements and provide a roadmap tailored to your organisation.

Can DORA readiness be delivered as a project?

Yes. A defined assessment and roadmap engagement is often the right first step. Ongoing resilience management, however, benefits from continued ownership - such as Virtual CISO support - when your obligations, customer base, or dependencies require sustained attention.

DORA Readiness & Digital Operational Resilience Support

About DORA

DORA (the Digital Operational Resilience Act) is the EU rulebook for how financial entities and their ICT providers manage technology risk, incidents, testing, and third-party dependencies. Digital Operational Resilience Act (DORA) expectations go beyond traditional cybersecurity controls. They concern whether an organisation can identify, withstand, respond to, recover from, and learn from technology-related disruption while continuing to deliver important services.

For financial entities, DORA places digital operational resilience at the centre of governance, ICT risk management, incident handling, testing, and third-party oversight. For ICT providers - including cloud, SaaS, security, data, and technology vendors - DORA increasingly appears in customer due diligence, contracts, security questionnaires, resilience discussions, and supplier-management requirements.

Boxfish Labs helps founders, leaders, security teams, and operational teams turn DORA into a manageable programme. We assess your current maturity, identify the obligations and customer expectations most relevant to your role, and create a proportionate roadmap for stronger resilience. The focus is on usable routines, accountable decisions, clear evidence, and improvements that support both regulatory readiness and business continuity.

What DORA means in practice

DORA is about the resilience of digital operations. In practice, organisations need to show that they can manage ICT-related risk and continue delivering important services through disruption.

Depending on your role and scope, this commonly involves:

Governance, accountability, and leadership oversight of ICT risk
A documented approach to identifying, assessing, treating, and monitoring technology risk
Asset, system, data, dependency, and critical-service visibility
Incident detection, classification, response, escalation, communication, and learning
Business continuity, disaster recovery, backup, recovery, and operational resilience planning
Digital operational resilience testing that is appropriate to your risk and services
Oversight of ICT third-party providers, outsourcing arrangements, contracts, concentration risk, and exit options
Clear evidence, reporting, and continuous improvement

The details matter, but the practical question is simple: can your organisation explain how it will protect and maintain important services when technology, suppliers, people, systems, or external events fail?

Challenges we help solve

You are unsure whether DORA applies to you

We help clarify your position: whether you are a regulated financial entity, an ICT provider supporting one, or a company facing DORA-derived customer expectations. We translate that context into practical priorities without treating every organisation as identical.

DORA questions are arriving through customers and contracts

We help SaaS, cloud, security, data, and technology providers understand and respond to DORA-related due diligence, contract clauses, supplier questionnaires, resilience evidence requests, and operational expectations.

ICT risk is not visible to leadership

We establish a clearer view of systems, assets, data, dependencies, risks, ownership, and residual exposure, so leaders can make informed choices about resilience investment and risk acceptance.

Supplier and cloud dependencies are unclear

We map critical third parties, subcontractors, cloud services, data flows, access arrangements, concentration risks, contractual commitments, recovery dependencies, and possible exit or contingency options.

Incident response is informal or untested

We help build practical incident-management and crisis-response routines: detection, classification, escalation, roles, communications, decision making, post-incident learning, and relevant documentation.

Resilience exists in pieces but not as a programme

We connect security, continuity, supplier governance, privacy, architecture, awareness, policies, risk management, and leadership reporting into a coherent operational-resilience approach.

People are not prepared to recognise or escalate risk

We design human-centred awareness and scenario-based learning to strengthen everyday reporting, incident escalation, secure behaviour, and team confidence during disruptive events.

A practical DORA readiness roadmap

01 - Clarify relevance and scope

Understand your role in the financial ecosystem, important services, customers, regulatory and contractual context, critical systems, data, suppliers, and immediate DORA-related expectations.

02 - Assess ICT risk and resilience maturity

Review governance, policies, asset and dependency visibility, risk management, incident response, continuity, testing, supplier oversight, reporting, evidence, and current gaps.

03 - Prioritise critical improvements

Create a proportionate roadmap based on the importance of services, risk exposure, customer commitments, regulatory relevance, implementation effort, and available capacity. Address urgent weaknesses without losing sight of the wider programme.

04 - Build and test operating routines

Implement or strengthen governance, risk registers, incident processes, continuity plans, supplier reviews, contractual controls, reporting, awareness, documentation, and testing practices.

05 - Monitor, report, and improve

Review resilience over time through leadership reporting, supplier monitoring, incident lessons, testing outcomes, internal checks, customer feedback, and changes to your technology or business model.

Key DORA capability areas

ICT risk management

A structured approach to identifying, assessing, treating, monitoring, and reporting risks related to technology, systems, data, people, processes, and dependencies.

Governance and accountability

Clear responsibilities, leadership oversight, decision-making authority, risk acceptance, policy ownership, resource decisions, and reporting that make resilience a management responsibility - not an isolated technical task.

Incident management and reporting

Practical routines for detecting, classifying, recording, escalating, investigating, communicating about, responding to, recovering from, and learning from ICT-related incidents.

Business continuity and recovery

Plans and capabilities for maintaining or restoring important services during disruption. This includes recovery priorities, backups, recovery testing, communication, alternative arrangements, and lessons learned.

Digital operational resilience testing

Testing and exercising appropriate to the organisation’s services and risk. This may include scenario exercises, tabletop sessions, technical tests, recovery tests, or more advanced forms of testing where required.

ICT third-party risk management

Visibility and oversight of cloud, SaaS, data, security, development, hosting, support, and other ICT providers. This includes criticality, concentration, contracts, security expectations, monitoring, exit planning, and subcontractor awareness.

Data, cloud, and sovereignty dependencies

Understanding where information and workloads reside, who controls access, which jurisdictions and suppliers are involved, how data and services can be recovered, and what alternatives exist if a dependency fails.

Outcomes

A clearer view of the DORA obligations, customer expectations, and resilience priorities relevant to your organisation
Stronger governance, ownership, and leadership visibility of ICT-related risk
A proportionate roadmap for improving digital operational resilience
Better incident readiness, continuity planning, recovery confidence, and learning after disruption
More robust oversight of cloud, SaaS, outsourcing, and critical ICT suppliers
More credible DORA-related responses for procurement, contracts, customer due diligence, audits, and regulators
Security, privacy, supplier, data, and human-risk work connected into one practical resilience programme

Need a practical path to stronger digital operational resilience?

Tell us whether you are a financial entity, an ICT provider, or responding to a customer’s DORA-related request. We will help you identify the risks, evidence, and next steps that matter most.

Book a Call

Build digital operational resilience into the way your organisation works.