RhymetecNew York, NY, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
DORA
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, is the EU rule that makes financial firms prove they can keep operating through ICT failures and cyber attacks.
It applies directly in every member state from January 17, 2025 and covers five areas: ICT risk management, ICT incident reporting, digital operational resilience testing, management of ICT third-party risk, and information sharing. It also brings the largest ICT providers to the financial sector under direct oversight by the European Supervisory Authorities.
On paper, a financial entity needs a documented ICT risk management framework approved by its management body and reviewed at least once a year, an ICT business continuity policy and response and recovery plans, an incident classification and reporting procedure, a testing program, a policy on the use of ICT third-party services, and a register of information listing every ICT contract.
Smaller entities may use the simplified framework, but the documents still have to exist.
Share
Ad from the publisher
DORA
help
help
Consultants Assessors Quotes
Matched3 quotesone form
The Shortlist is Yoursfrom this directory
Comply the Modern WayFind help with DORA
01
Listings sourced
A card shows a public register or the date we read the firm’s website
02
Published prices where they exist
“Quote only” where we confirmed it, “Not published” where we have not
03
Up to three quotes, one form
Firms don’t see you until you choose
House ad. This slot is open to firms listed for this page.
Get help →Advertise here →
Who has to comply
Around twenty categories of EU financial entities including credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, central securities depositories, trading venues, insurers and reinsurers, insurance intermediaries above the size threshold, and fund managers.
ICT third-party providers designated as critical fall under the ESAs' oversight framework.
What you have to write
Documents on this site that DORA requires or expects, each with who must have it, the review cycle and the obligations that cite it.
- Business Continuity and Disaster Recovery Plan Information security
What the assessor asks to see
Supervisors ask for the management-body-approved ICT risk management framework and evidence of its annual review, the ICT asset inventory and business impact analysis, the ICT business continuity policy and tested response and recovery plans, the incident classification procedure and incident log with reports filed, the testing program and results, the ICT third-party policy, the register of information with contract clauses, exit strategies for critical providers, and training records for the management body.
Where the requirement sits: DORA Arts 5-16, 17-23, 24-27, 28-30
Key dates
Adopted December 14, 2022; published in the Official Journal December 27, 2022; applies from January 17, 2025. Regulatory and implementing technical standards on incident classification, the register of information, and subcontracting were finalized in 2024 and 2025. First annual submissions of registers of information ran through national authorities in 2025.
Who helps with DORA
A large consulting market of Big Four practices, cyber and GRC consultancies, and law firms. Engagements typically run a gap assessment, draft the ICT risk framework and third-party policy, build the register of information, and set up the incident classification process. Threat-led penetration testing must be run by qualified testers under the TIBER-EU style framework.
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Listed in random order, reshuffled each time the page loads. Firms that pay for a listing are shown at the top, labeled Sponsored.
TestprosSterling, Virginia
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Atlant SecurityUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
VISTA InfoSecMumbai, India
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
IsecurionBengaluru, Karnataka, India
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Precursor SecurityLeeds, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 27001, PCI DSS, GDPR, Cyber Essentials and more.
- Standards
- Pricing
- Not published
Nettitude (LRQA Cyber Security)Birmingham, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, SOC 2, CMMC, Cyber Essentials.
- Standards
- Pricing
- Not published
CognisysLeeds, UK, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, CMMC, NIST 800-171, PCI DSS, GDPR and more.
- Standards
- Pricing
- Not published
Hetvik Corporate SolutionsIndia
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 27001, SOC 2, ISO 9001, HIPAA and more.
- Standards
- Pricing
- Not published
WorkNest (Secure and ISO services)Aldford, Chester, Cheshire, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 27001, SOC 2, ISO 9001, PCI DSS and more.
- Standards
- Pricing
- Not published
Cyber Security SpecialistsAltrincham, Greater Manchester, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 27001, SOC 2, PCI DSS, GDPR and more.
- Standards
- Pricing
- Not published
Integrity360Dublin, Ireland
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, PCI DSS, GDPR, NIST CSF, ISO 27701 and more.
- Standards
- Pricing
- Not published
BH ConsultingDublin 15, Ireland
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, PCI DSS, GDPR, NIST CSF, ISO 42001 and more.
- Standards
- Pricing
- Not published
Risk CrewLondon, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, PCI DSS, GDPR, ISO 42001, Cyber Essentials and more.
- Standards
- Pricing
- Not published
Microminder Cyber SecurityStanmore, London, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, SOC 2, NIST 800-171, PCI DSS, GDPR and more.
- Standards
- Pricing
- Not published
Evolve NorthRichmond, North Yorkshire, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, PCI DSS, GDPR, ISO 42001, DSPT and more.
- Standards
- Pricing
- Not published
Toro Risk SolutionsLondon, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 9001, GDPR, NIST CSF, ISO 22301 and more.
- Standards
- Pricing
- Not published
DigitalXRAIDDoncaster, South Yorkshire, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 27001, SOC 2, GDPR, DSPT and more.
- Standards
- Pricing
- Not published
PGI (Protection Group International)London, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, PCI DSS, GDPR, ISO 42001, ISO 22301 and more.
- Standards
- Pricing
- Not published
ThriveUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
CyturityHouston, TX, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 27001, SOC 2, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
Axiom GRCUK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 27001, ISO 9001, CMMC, PCI DSS and more.
- Standards
- Pricing
- Not published
SapphireNewcastle upon Tyne, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 27001, PCI DSS, ISO 42001, Cyber Essentials and more.
- Standards
- Pricing
- Not published
Saepio Information Security
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 27001, SOC 2, PCI DSS, GDPR and more.
- Standards
- Pricing
- Not published
Caladium Cyber
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 27001, NIST CSF, Cyber Essentials, NCSC CAF and more.
- Standards
- Pricing
- Not published
Cyber Alchemy Ltd.Rotherham, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 27001, PCI DSS, GDPR, Cyber Essentials and more.
- Standards
- Pricing
- Not published
Technoserve IT Consulting LTDLondon, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, GDPR, ISO 42001, EU AI Act.
- Standards
- Pricing
- Not published
ForgePath SecurityNorfolk, Virginia, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for DORA, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Who assesses DORA
National competent authorities for each entity type (for example BaFin, the CSSF, the Central Bank of Ireland, the AMF and ACPR) supervise and enforce. The ESAs act as lead overseers for critical ICT third-party providers. There is no certification scheme; supervision is by regulator review and inspection.
Supervisory authority is set out in the regulation and national implementing law.
Assessors
Be the first DORA assessor listed here
This page is read by the organizations looking for someone to certify them.
Tools for DORA
Tools that name this framework in their own material.
Grouped by type. Inside each group the order is random, reshuffled each time the page loads.
GRC and compliance automation27 tools
Controls, evidence and audit workflows, with a policy module inside.
DrataSecurity-compliance automationQuote onlyISMS.onlineBrighton, United KingdomCompliance management platformQuote onlycSquare GRCA JNN Group companyCompliance management platformPrice publishedScytaleCompliance automation platform with a compliance-expert serviceNot publishedStrike GraphAI-native GRC and compliance automation platformPrice publishedControlMapGRC platform built for managed service providersPrice publishedOneleetCompliance automation platform with security built inQuote onlyCompylAI GRC and compliance automation platformNot publishedCoplaCompliance automation platform with a CISO advisory teamNot publishedSecfixGermanyCompliance automation platformNot publishedOneTrustGRC platform for privacy, consent, AI governance and third-party riskNot published6clicksAustraliaGRC platform for government, defense and critical infrastructure, and for advisorsNot publishedRegScaleContinuous controls monitoring and compliance automation platformNot publishedSAI360Chicago, IL, United StatesCompliance management platform for ethics, risk and regulatory complianceQuote onlyComplAIUnited StatesContinuous compliance assurance platform for federal and regulated frameworksQuote onlyShieldIQDublin, IrelandAI-powered GRC platformPrice publishedComplyDoBerlin, GermanyCompliance automation platformNot publishedKertosMunich, GermanyCompliance automation platformQuote onlyFullyInControlNijmegen, NetherlandsGRC and ISMS compliance automation platformQuote onlyheygrcCompliance code review for pull requestsPrice publishedISMS CopilotFranceAI compliance assistant for consultants, CISOs and auditorsPrice publishedKopexaKiel, GermanyGRC and ISMS compliance platformPrice publishedKordonGRC platform covering risk, policy, control, asset, vendor and audit managementQuote onlyPeriumGroningen, NetherlandsRisk and compliance management platformNot publishedsmartGRCWroclaw, PolandAI agent platform for SAP access governancePrice publishedTidal Control's-Hertogenbosch, NetherlandsCompliance automation and GRC platformPrice publishedTrustBound GRCLeiden, NetherlandsGRC platform for information security, privacy and auditNot published
Third-party risk and trust centers6 tools
Vendor assessments, security ratings, questionnaires and trust pages.
OrbiqHamburg, GermanyTrust center and vendor assurance platformPrice publishedPanoraysNew York, NY, United StatesThird-party cyber risk management platformQuote onlyUpGuardMountain View, CA, United StatesThird-party risk and security ratings platformPrice publishedBitsightBoston, MA, United StatesSecurity ratings and third-party risk management platformQuote onlyProcessUnityConcord, MA, United StatesThird-party risk management (TPRM) platformQuote onlySecurityScorecardNew York, NY, United StatesThird-party risk and security ratings platformQuote only
Privacy and data governance3 tools
Consent, data maps and data subject requests under GDPR, CCPA and similar laws.
Policy management tools1 tool
Approve, distribute and acknowledge written policies.
AI governance1 tool
Inventories, risk assessments and controls for AI systems under the EU AI Act, ISO 42001 and NIST AI RMF.
Related reading
- The EU's Digital Operational Resilience Act (DORA) - 2024 UpdateCovers scope, the contract terms firms must renegotiate with ICT providers, and the board-level duties DORA creates.Skadden, Arps, Slate, Meagher & Flom
- Cybersecurity in the Financial Sector: EU's Digital Operational Resilience Act Takes EffectBreaks DORA into its pillars and names the documents in scope, from the information security policy to the register of information.Mayer Brown
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Find a Consultant for DORA
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Not sure where to start?
Get Help with DORA
Tell us what you are trying to put in place. We will point you to the right tool, a consultant who can implement it, or both.