DORA (Digital Operational Resilience Act) is now in force across the EU. The early audits have begun. Many financial-services organizations are discovering that what they thought was DORA-compliant isn’t.
1. ICT third-party register is incomplete. DORA requires a complete register of ICT third-party providers, classified by criticality. Most banks have a procurement record but not a control-risk-classified register.
2. Operational-resilience testing is theoretical. DORA requires regular testing of operational-resilience scenarios. Tabletop exercises don’t qualify; you need actual recovery validation.
3. Incident reporting timing is misunderstood. DORA timing requirements are aggressive. Most organizations’ incident-reporting workflows weren’t designed for sub-4-hour reporting.
Build the register first (most foundational). Run an actual recovery test (will surface real gaps). Tighten incident-reporting workflows (operational change, not technical).
Connect with a Mergen architect to scope an outcome-led engagement.
Connect with a certified architect and explore how Mergen can accelerate your transformation.
Receive a comprehensive platform health check and a prioritized roadmap.
See how organizations like yours achieved measurable results.
Ready to go? Tell us about your initiative and we'll scope an engagement in 48 hours.