Skip to content
Book a consultation
МКEN

DORA compliance

DORA compliance for EU financial groups and their ICT providers

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, applies to EU financial entities from 17 January 2025. It does not apply directly in North Macedonia, but it matters here for local subsidiaries of EU banking and insurance groups and for ICT providers that serve EU financial entities. We help you meet what your group or your clients expect: sound ICT risk management, incident processes, resilience testing and oversight of third parties.

Book a consultationHow it works
  1. 01ICT risk management
  2. 02Incident classification and reporting
  3. 03Digital operational resilience testing
  4. 04ICT third-party risk
  5. 05Information sharing
DORA's five areas, as they are commonly grouped

DORA compliance

What you get

01

A clear position

You know which DORA requirements reach you through your group or your EU clients, and how they sit alongside your local obligations.

02

A prioritized plan

A gap assessment across the areas DORA covers gives you a plan that your group, clients and management can follow and track.

03

Tested, not assumed

A testing programme shows how your critical systems hold up against realistic attack scenarios and where they need work.

04

Third parties under control

ICT providers are inventoried, assessed and documented in a way that supports the register of information.

What's included

  • Applicability review based on your entity, group structure and EU clients
  • Gap assessment across ICT risk management, incident reporting, resilience testing, third-party risk and information sharing
  • ICT risk management framework, policies and procedures aligned with group requirements
  • ICT incident management and classification process, with clear reporting lines to your group or EU clients
  • A resilience testing programme, from vulnerability assessments and scenario exercises to penetration testing
  • ICT third-party risk process: due diligence, contract requirements, exit plans and support for the register of information
  • Guidance on arrangements for sharing cyber threat information
  • For ICT providers: clear evidence for your EU financial clients’ DORA due diligence

How we work

  1. 01

    Applicability and scope

    We clarify how DORA reaches you, whether through your EU parent group, through contracts with EU financial clients or both, and agree which services and systems are in scope.

  2. 02

    Gap assessment

    We compare your practices with the areas DORA requirements are commonly grouped into and with your group’s or clients’ own requirements, then rank the gaps by risk and effort.

  3. 03

    Policies and processes

    We write or update your ICT risk, incident and third-party processes so they fit your group’s framework and feed its reporting.

  4. 04

    Testing programme

    With our penetration testing team we plan and run resilience tests, from vulnerability assessments to scenario-based tests, and track every finding to closure.

  5. 05

    Evidence and review

    We organize the evidence your group, clients or auditors ask for and review the programme as your services, your providers and the rules change.

Who it's for

  • Local subsidiaries of EU banking and insurance groups
  • ICT and software providers serving banks, insurers and other EU financial entities
  • Local financial firms that use DORA as a benchmark alongside the NIS2-aligned law

Frameworks and standards

  • Regulation (EU) 2022/2554 (DORA)
  • ISO/IEC 27001:2022
  • NIST SP 800-61 Rev. 3
  • NIST SP 800-115

Frequently asked questions

Does DORA apply in North Macedonia?
Not directly. DORA is an EU regulation and North Macedonia is not an EU member, so it does not bind entities that operate only here. It matters in two cases: you are a subsidiary of an EU banking or insurance group, or you provide ICT services to EU financial entities. In both cases its requirements usually reach you through group policies or client contracts.
What areas does DORA cover?
Its requirements are commonly grouped into five areas: ICT risk management; ICT incident management, classification and reporting; digital operational resilience testing; ICT third-party risk, including the register of information; and information sharing. The grouping is a convenient summary of the regulation’s chapters, not legal wording.
We are an ICT provider. What will EU financial clients ask of us?
Expect questions about your security controls, incident notification, business continuity, subcontractors, audit and access rights, and support if the contract ends. Financial entities must manage ICT third-party risk and keep a register of information on their ICT arrangements, so they need accurate information from you. We help you prepare clear answers and the evidence behind them.
How does DORA relate to the NIS2-aligned law and ISO 27001?
They overlap. Within the EU, DORA sets sector-specific rules on digital operational resilience for financial entities. In North Macedonia, banking and the financial market are among the sectors the NIS2-aligned law already covers, and ISO/IEC 27001 provides a management system that supports both. We map the overlaps so one set of controls and evidence serves several requirements.
Do you run the resilience tests yourselves?
Yes, for vulnerability assessments, penetration tests and scenario-based tests: our penetration testing and red teaming team runs them, and we help you design the wider programme: what to test, how often, and how findings are fixed and reported. Where your group or its supervisor sets specific testing rules, we work to them. Threat-led penetration testing (TLPT) under Articles 26 and 27 has its own requirements for testers, and we confirm up front whether we meet them.

Related services

Penetration testing & red teamingManual testing of networks, applications, cloud and people, with CVSS-rated findings, clear reports and a retest of fixes.Learn moreIncident response & forensicsPlans, playbooks and exercises before an incident; containment, forensics and reporting support when one happens.Learn moreISO 27001 implementationAn ISO/IEC 27001:2022 management system built around your risks, from scoping and controls to the certification audit.Learn more

Let’s talk about your security

Tell us what you need: 24/7 monitoring, testing or readiness for the NIS2-aligned law. In a short call we will agree on scope and next steps.

Book a consultation+389 75 340 034

Mon–Fri 09:00–17:00 · SOC 24/7 · info@diverto.mk