We begin with a DORA compliance assessment to understand how current ICT risk management, policies, and controls align with regulatory requirements. This includes a maturity review and gap analysis, highlighting areas that require remediation and where to focus first.
02
Remediation planning & roadmap
Assessment findings are mapped to DORA requirements and translated into a clear, realistic roadmap outlining required actions and timelines.
03
DORA controls implementation
We support the end-to-end implementation of agreed organisational and technical controls, including ISMS implementation, ICT asset management and ownership, incident response, disaster recovery, and business continuity planning.
04
Ongoing DORA compliance
Through CISO for DORA services, we provide ongoing support to help organisations maintain compliance as risks, systems, and regulatory expectations evolve. This includes ongoing risk monitoring, control effectiveness reviews, and support with regulatory reporting and supervisory interactions when required.
Why Baltic Amadeus
Compliance-first approach.
Certified experts.
Senior security guidance.
Certifications
CISA
ISO 27001
CISSP
CISM
FAQ
How much does DORA compliance support typically cost?
It depends on where you are starting from. Some organisations only need a short readiness review, while others need help with implementation or ongoing support. We usually start by understanding your setup and then suggest a scope that fits your needs and budget.
How does DORA relate to NIS2 and ISO 27001?
They cover similar topics, but they are not the same. DORA is a mandatory regulation for the EU financial sector. NIS2 applies to a wider range of organisations, and ISO 27001 is a voluntary standard. If you already work with NIS2 or ISO 27001, you are part of the way there, but DORA still adds its own requirements.
What are the main DORA requirements?
DORA is about helping EU financial organisations stay operational during disruptions. It sets clear rules for ICT risk management, incident reporting, business continuity and recovery planning, resilience testing, and oversight of critical ICT suppliers.
.svg)
