DORA (Digital Operational Resilience Act) is now in force across the EU. The early audits have begun. Many financial-services organizations are discovering that what they thought was DORA-compliant isn’t.
1. ICT third-party register is incomplete. DORA requires a complete register of ICT third-party providers, classified by criticality. Most banks have a procurement record but not a control-risk-classified register.
2. Operational-resilience testing is theoretical. DORA requires regular testing of operational-resilience scenarios. Tabletop exercises don’t qualify; you need actual recovery validation.
3. Incident reporting timing is misunderstood. DORA timing requirements are aggressive. Most organizations’ incident-reporting workflows weren’t designed for sub-4-hour reporting.
Build the register first (most foundational). Run an actual recovery test (will surface real gaps). Tighten incident-reporting workflows (operational change, not technical).
Whether you're modernizing an existing platform, implementing new capabilities, or exploring AI-driven transformation, Mergen's certified experts will help define the right roadmap, scope, and delivery approach for your business.
Book a Discovery Call