DORA affects third party ICT providers to financial institutions by imposing mandatory rules on their operations.
Services for ICT service providers include:
1. Advice on the implementation of DORA regulation, in particular the following topics:
- Analysing whether the ICT service provider and ICT services fall under the effect of DORA
- Analysing whether the ICT service/service provider qualifies as which supports critical or important function of the financial entity
- Analysing whether the ICT service provider qualifies as key (critical) provider
- Due diligence by financial institutions
- Registering of LEI numbers
- Interplay between NIS2 and DORA
2. Assistance in the preparation of the necessary DORA documentation:
- Preparing checklist for internal policies and procedures
- Internal policies, such as Information Security Policy, ICT Business Continuity Plan, Disaster Recovery Plan
- Incident management policies and processes
3. Trainings for board members and employees responsible for DORA compliance:
- Preparing the training materials: PPT presentation and word summary
- Answering client-specific questions
4. Assistance in contracting with financial institutions:
- Preparing DORA contract template with financial institutions including the mandatory contractual provisions
- Preparing DORA questionnaire for self-assessment purposes
- Preparing DORA due diligence questionnaire for ICT subcontractors
- Assisting in completing the due diligence questionnaire of financial institutions
- Negotiating all the DORA contracts with ICT service providers:
- Preparing the ICT service provider specific DORA contracts, including the individually negotiated parts from the previous outsourcing contracts,
- Negotiating the contracts with the financial institutions.
5. Assistance in reporting and managing ICT related incidents/events to the financial institution:
- Assisting in risk analysis
- Assisting in classification of ICT related incidents/events
- Preparing incident reports
- Assisting in crisis communication
6. To critical ICT service providers:
Special services to critical ICT service providers:
- Analysing whether the ICT service provider qualifies as key (critical) provider
- Representation in supervising framework before the lead authority in the different proceeding (general investigation, controls, continuous supervision, etc.)
