DORA Implementation: Project Governance, Testing & Third-Party Evidence
DORA sets EU-wide requirements for digital operational resilience across the financial sector. I bring program management discipline to multi-jurisdictional DORA implementations - with evidence frameworks that satisfy EBA, ECB, and local supervisors.
EU-Wide Operational Resilience
The Digital Operational Resilience Act creates a unified framework for ICT risk management across the European Union. For international financial groups, this means:
- Harmonized ICT Risk: Consistent risk management framework across all EU entities
- Cross-Border Testing: Coordinated resilience testing including TLPT for entities designated by competent authorities
- Third-Party Oversight: Group-level management of critical ICT service providers
- Unified Incident Reporting: Consolidated reporting channels meeting multiple supervisory requirements
Deliverables: EU-Wide Evidence Framework
Structured evidence framework designed for multi-regulator environments - from EBA to national competent authorities.
Cross-Border Third-Party Risk
DORA introduces an EU-level oversight framework for designated critical ICT third-party providers (CTPPs), and it raises the bar for group-wide ICT third-party risk management. I support with:
- Group-level provider mapping and criticality assessment
- Control harmonization across jurisdictions
- Vendor governance: consolidated reporting and exit planning
- Preparation for ESA oversight of designated CTPPs
Multi-Entity Resilience Testing
DORA mandates coordinated testing across connected entities. I support with planning and evidence coordination:
- Group-wide test strategy with local entity requirements
- Cross-border scenario coordination with providers
- Consolidated evidence management and remediation tracking
- TLPT preparation for entities designated by competent authorities
Collaboration with Compliance / IT Risk
DORA implementation is not purely an IT topic. I work closely with the second line (Compliance, IT Risk) to:
- Formulate controls that are both implementable AND auditable
- Align reporting structures (management, supervisory authorities)
- Close gaps between interpretation and implementation
Project contexts are anonymized. Roles and results are truthful; details available under NDA.
Frequently Asked Questions
Related Services
Let's talk about your project
No-obligation initial conversation - get concrete insights about your initiative.
Last updated: January 2026