DORA Consulting
DORA consulting is advisory and implementation support that helps a financial entity design and operationalise the controls, contracts, policies, and testing needed to meet DORA. It bridges the gap between knowing the requirements and embedding them in day-to-day operations.
What consultants deliver
Typical work includes building the ICT risk-management framework, drafting DORA-aligned contract clauses, designing the incident-response process, and standing up the resilience-testing programme. Good consultants transfer knowledge so the entity can sustain compliance in-house.
What to look for in a provider
Prioritise demonstrable DORA-specific expertise, coverage of your entity type, and evidence of regulatory engagement. Our published methodology scores providers on exactly these dimensions, see the ranked directory.
Which rulebook applies now
Part of a consultant's job is knowing when an older rulebook still binds a client and when it has been superseded. Before DORA, ICT risk at banks, payment institutions, and e-money institutions was partly governed by the EBA's 2019 Guidelines on ICT and security risk management. Once DORA's own ICT risk-management framework(Articles 5–16) became directly applicable law for the same entities, keeping both rulebooks in force risked duplicate, sometimes conflicting requirements. On 11 February 2025 the EBA published amended guidelines (EBA/GL/2025/02) that repeal almost all of the 2019 text for entities within DORA's scope, leaving only a narrow provision on relationship management with payment service users, effective from 20 May 2025. For a DORA-covered client, the working rulebook for ICT risk is now DORA itself and its technical standards, not the older EBA guidelines; for entities outside DORA's scope, the 2019 guidelines still apply in full. Getting this scoping question right early avoids building a programme against the wrong baseline.
Frequently asked questions
How is consulting different from a DORA audit?
Consulting helps you build and improve controls; a DORA audit independently checks them. For independence, some entities keep the two separate.
Can smaller entities use DORA consulting?
Yes. DORA applies proportionately, and consultants often scope a lighter engagement for microenterprises and smaller firms subject to the simplified framework.
How do I choose a DORA consultant?
Assess DORA-specific track record, entity-type coverage, and independence. See our ranking methodology.
Do the EBA's pre-DORA ICT guidelines still apply to my entity?
Mostly no, if your entity is within DORA's scope. The EBA repealed almost all of its 2019 Guidelines on ICT and security risk management for DORA-covered entities from 20 May 2025, other than a narrow payment-service-user provision; DORA itself is now the operative rulebook.