Resilience you can evidence to a regulator.

Financial services has never been short of security policy. What DORA changed is the standard of proof. It is no longer enough to have a framework, a register and an annual attestation. A regulator now expects to see that resilience has been tested, that critical third parties are mapped and monitored, and that someone can produce the evidence on request.

For most firms the gap is not knowledge, it is capacity and evidence. The policies exist. The register is incomplete. The testing was done two years ago by someone who has left. The remediation from the last assessment is still open.

We scope against the obligation rather than against a generic framework. A DORA gap assessment that names what is missing and what it will take to close it, then the delivery capacity to actually close it. Third party risk work that produces a register a regulator will accept rather than a spreadsheet. Threat led testing to TIBER-EU where that is the requirement.

Our consultants are selected on whether their work has survived regulatory review, and on whether they can write as well as they can assess. In this sector the document is the deliverable.