ICT and DORA documentation
The ICT risk framework, register of information and DORA policies regulators ask for.
EU financial entities, including crypto-asset service providers, payment institutions and e-money institutions, must document how they manage ICT risk under DORA. We write that documentation so it describes your systems as they actually run, and we review existing frameworks and tell you plainly where they fall short.
What you get
- ICT risk management framework
- The DORA ICT risk management framework and supporting policies, sized to the firm and its services.
- Register of information
- Preparation of the DORA register of information on ICT third-party arrangements, in the format the competent authority expects.
- Incident management
- ICT incident classification, response and reporting procedures, including the regulatory reporting flow.
- Business continuity and recovery
- Business continuity policy, ICT response and recovery plans, and a test plan for them.
- Gap review
- Review of existing ICT documentation against DORA and the target licence, with a prioritised list of gaps.
How it runs
- Step 1ScopeWe confirm which DORA obligations apply to your licence and size, and which simplifications you can use.
- Step 2MapWe map your systems, providers and current documentation against those obligations.
- Step 3WriteWe draft the framework, policies and register, aligned with how your systems are actually built.
- Step 4Hand overWe walk your team through the documents so they can keep them current and answer regulator questions.
Questions we get
Does DORA apply to us?
It depends on the licence. DORA applies to a defined list of financial entities, including authorised crypto-asset service providers, payment institutions and e-money institutions in the EU. We confirm scope at the start of each engagement.
Can you use our existing policies?
Yes. Where your documents are sound we adapt them rather than start again, and we mark what changed and why.