What should organisations keep doing for DORA compliance?

For many organisations, the main challenge is no longer understanding DORA. The challenge is keeping it working in practice. That means turning regulatory requirements into repeatable processes, regular testing, clear reporting and visible management oversight.

ICT risk management

• Keep governance, risk assessments, asset insight, protection, detection and response, recovery, backups and improvement cycles up to date.

• How Northwave helps: Boardroom training, ICT risk assessments, internal audits, governance support and control improvement.

Incident management

• Maintain clear incident processes, classification rules, escalation paths and reporting routines.

• How Northwave helps: Review, improve and test BCPs, IRPs and crisis management plans, including escalation, communication and reporting.

Resilience testing

• Test systems, controls, recovery plans and, where required, advanced scenarios such as Threat-Led Penetration Testing (TLPT).

• How Northwave helps: Vulnerability assessments, security testing, penetration testing, scenario exercises, red teaming and TLPT.

ICT third-party risk

• Keep suppliers under control through due diligence, contract requirements, monitoring and an up-to-date register of information.

• How Northwave helps: Supplier risk process implementation or improvement, supplier audits, due diligence, monitoring and register support.
  

Broader DORA requirements

• How Northwave helps: Awareness programme, security monitoring, vulnerability management, backup and recovery, policy updates and recurring reporting.