Skip to main content

      DORA has applied since 17 January 2025. It requires financial entities to withstand, respond to and recover from ICT disruption, places overall responsibility on the management body and extends supervisory reach to critical ICT third-party providers.

      With supervisors now testing implementation, the focus has moved from building frameworks to demonstrating that they work. We help financial entities close remaining gaps, embed DORA into business-as-usual and prepare for supervisory review.

      The five pillars

      • ICT risk management
      • ICT incident management, classification and reporting
      • Digital operational resilience testing, including TLPT
      • ICT third-party risk and the Register of Information
      • Information sharing

      Our approach

      • Assess

        Gap analysis and benchmarking to size, prioritise and plan

      • Design

        Frameworks, policies and processes building on existing structures

      • Implement

         Programme delivery, registers, reporting and testing

      • Sustain

        Ongoing compliance, assurance and supervisory engagement

      What you get

      • DORA gap register and remediation roadmap
      • ICT risk management framework and digital operational resilience strategy
      • Incident classification and reporting playbooks
      • Register of Information and contract remediation support

      Contact

      Constantinos Gavardinas

      Partner, Advisory

      KPMG in Greece

      Nikolaos Fellas
      Nikolaos Fellas

      Senior Manager, Management Consulting

      KPMG in Greece