DORA asks for records, kept as you go
Since 17 January 2025, DORA has asked banks, insurers, investment firms and payment and e-money institutions for an ICT risk framework, a register of their technology providers, incident reports on fixed clocks and set contract terms. Each one is a record that has to stay current.
What DORA asks for
Whether DORA applies to your firm, and in full or in its simplified form, is set by Article 2 and the type of firm. The scoping questions on eurus.ie show which rules apply and the provision each rests on.
- A register of information on every contract with an ICT third-party service provider (Article 28(3)).
- Major ICT-related incidents classified and reported to the competent authority, in Ireland the Central Bank, on set deadlines (Article 19).
- Contracts with ICT providers that carry the terms Article 30 sets.
- An ICT risk management framework, reviewed and tested.
Why this is Eurus and not Protect
Protect is a fixed programme for businesses with 5 to 50 staff. A regulated firm needs its records checked as they are made: each provider, each incident, each change of access. That is Eurus, our compliance platform, and FourWinds runs on it.
What we do
The Eurus audit, €6,300 fixed, once
Seven days: your systems and processes mapped to the controls DORA, the GDPR and NIS2 ask of you, the gaps, and a fixed-price plan to close them. Then Eurus checks each record as it is made and keeps the proof for your auditor.
Read first
Start here
The free compliance check looks at your website and email from outside while you answer a few questions, and keeps the result as your compliance record. Or tell us what you have been asked, and we tell you what to do first.