Skip to content

Services, Wiki-Artikel und Blog-Beiträge durchsuchen

↑↓NavigierenEnterÖffnenESCSchließen

DORA Compliance Consulting

DORA Compliance:
End-to-end,
fixed-price

DORA has been in force since 17 January 2025. We support financial entities from gap analysis through ICT risk management build-out to the annual penetration test per Art. 25 - all from a single source, transparently priced.

Free initial consultation +49 209 8830 6760
ISO 27001 certified Fixed-price commitment DORA expertise since 2024

AWARE7 DORA Services

Art. 5-16
Gap Analysis & ICT Risk Management
Complete inventory and action plan
Art. 17-23
Incident Management & Reporting
Establish 4-hour and 72-hour reporting processes
Art. 24-27
Resilience Testing & TLPT
Annual pentests and TIBER-EU red-team tests
Art. 28-44
Third-Party Register & Contract Review
Build register, check contracts for DORA clauses

Trusted by our clients

Security analyses conducted
500+
Years of experience
8+
To fixed-price quote
24h
Permanent staff experts
100%

Our Services

The 5 DORA pillars - our services mapped

Each DORA requirement demands specific expertise. We cover all five pillars with concrete consulting services - from a single source.

Art. 5-16

ICT Risk Management

Build or extend the ICT risk management framework per Art. 5-16: asset inventory, risk assessment procedures, protective measures, and board-level anchoring. For ISO 27001 organisations: efficient delta mapping to DORA-specific requirements.

  • + Gap analysis
  • + Asset inventory
  • + Risk management framework
  • + Business continuity plan
Art. 17-23

Incident Reporting

Development and implementation of complete incident classification and reporting processes ensuring the 4-hour initial notification and 72-hour interim report to the relevant authority. Including EBA RTS-compliant reporting templates and escalation matrices.

  • + Classification procedures
  • + 4h/72h reporting processes
  • + Regulatory reporting templates
  • + SIEM integration (optional)
Art. 24-27

Resilience Testing

Annual penetration tests and vulnerability assessments per Art. 25 DORA for all affected financial entities. For significant institutions: preparation and conduct of Threat-Led Penetration Tests (TLPT) per TIBER-EU with OSCP-certified testers.

  • + Annual penetration tests
  • + Vulnerability assessments
  • + TLPT per TIBER-EU
  • + Supervisory coordination
Art. 28-44

ICT Third-Party Risks

Complete construction of the ICT third-party register per Art. 28: capture all service providers, criticality classification, concentration risk analysis. Contract analysis against DORA minimum clauses per Art. 30 and development of template contract clauses.

  • + Third-party register (Art. 28)
  • + Contract analysis (Art. 30)
  • + Concentration risk analysis
  • + Exit strategy templates
Art. 45

Information Sharing

Advisory on DORA-compliant build-out or joining of threat intelligence sharing communities per Art. 45. Data protection-compliant design of information exchange and connection to existing ISACs in the financial sector.

  • + ISAC membership advisory
  • + Data protection-compliant processes
  • + Threat intelligence integration
  • + Confidentiality framework
All Articles

Management Training

DORA requires the management body to take personal responsibility for ICT risk management and to demonstrate relevant knowledge. We offer compact DORA training for boards and senior management - practical and without unnecessary theory.

  • + DORA overview for executives
  • + Liability scenarios
  • + Supervisory communication
  • + Documentation obligations

Our approach

Our DORA consulting approach in 4 steps

Structured, transparent, and with clear milestones - this is how we guide you to demonstrable DORA compliance. All steps are calculable on a fixed-price basis.

01

Applicability analysis

Clarification of your DORA category per Art. 2, scope of applicable requirements, and review of proportionality provisions for your organisation. Result: clear classification and prioritisation.

Duration: 1-2 days
02

Gap analysis

Structured review of all existing ICT risk management measures, incident processes, and third-party contracts against all DORA requirements. Result: prioritised action plan.

Duration: 5-10 days
03

Third-party register

Complete construction of the ICT third-party register per Art. 28: capture all service providers, classify criticality, review contracts for DORA compliance, identify concentration risks.

Duration: 3-8 days
04

Penetration Testing Art. 25

Conduct of annual resilience tests per Art. 25 DORA. For significant institutions: preparation and coordination of the TLPT process per TIBER-EU including alignment with the competent authority.

Duration: annual / every 3 years
„DORA is not a paper exercise - supervisors review substantively. Financial entities that equate DORA compliance with a documentation package underestimate the requirements. Our strength is the combination of ISMS methodology and real penetration testing: we build DORA frameworks that can withstand a TLPT examination.“

Oskar Braun

ISO 27001 Lead Auditor (IRCA certified) · AWARE7 GmbH

Why AWARE7

DORA consulting from a single source

The combination of offensive security expertise and ISMS experience makes AWARE7 unique for DORA mandates - especially for the resilience testing requirements.

Offensive Security Expertise

AWARE7 has been conducting penetration tests for over 12 years. Our OSCP- and OSWA-certified testers know the attack techniques DORA resilience tests examine - and build your defences accordingly.

  • OSCP / OSWA / OSWP certificates
  • Red-team experience
  • TIBER-EU knowledge
  • 500+ penetration tests

ISMS & Compliance Experience

We are ourselves certified to ISO 27001 and ISO 9001. 20+ ISMS projects supported, all successfully certified, demonstrate our methodology. For DORA this means: no greenfield build, but efficient delta mapping based on existing ISMS structures.

  • ISO 27001 certified ourselves
  • 20+ ISMS projects
  • All projects successfully certified
  • NIS-2 synergies utilised

Everything from one source

Gap analysis, ICT risk management, third-party register, incident processes, and annual penetration tests - all from a single source. No coordination overhead between multiple providers, clear points of contact, consistent quality.

  • Unified methodology
  • Fixed-price quotes
  • 24h to quote
  • 100% permanent staff experts

Why AWARE7 for DORA consulting

Was uns von anderen Anbietern unterscheidet

Reine Awareness-Plattformen testen keine Systeme. Reine Beratungskonzerne sind zu weit weg. AWARE7 verbindet beides: Wir hacken Ihre Infrastruktur und schulen Ihre Mitarbeiter - mittelstandsgerecht, persönlich, ohne Enterprise-Overhead.

Forschung und Lehre als Fundament

Rund 20% unseres Umsatzes stammen aus Forschungsprojekten für BSI und BMBF. Unsere Studien analysieren Millionen von Websites und Zehntausende Phishing-E-Mails - publiziert auf ACM- und Springer-Konferenzen. Drei unserer Führungskräfte sind gleichzeitig Professoren an deutschen Hochschulen.

Digitale Souveränität - keine Kompromisse

Alle Daten werden ausschließlich in Deutschland gespeichert und verarbeitet - ohne US-Cloud-Anbieter. Keine Freelancer, keine Subunternehmer in der Wertschöpfung. Alle Mitarbeiter sind sozialversicherungspflichtig angestellt und einheitlich rechtlich verpflichtet. Auf Anfrage VS-NfD-konform.

Festpreis in 24h - planbare Projektzeiträume

Innerhalb von 24 Stunden erhalten Sie ein verbindliches Festpreisangebot - kein Stundensatz-Risiko, keine Nachforderungen, keine Überraschungen. Durch eingespieltes Team und standardisierte Prozesse erhalten Sie einen klaren Zeitplan mit definiertem Starttermin und Endtermin.

Ihr fester Ansprechpartner - jederzeit erreichbar

Ein persönlicher Projektleiter begleitet Sie vom Erstgespräch bis zum Re-Test. Sie buchen Termine direkt bei Ihrem Ansprechpartner - keine Ticket-Systeme, kein Callcenter, kein Wechsel zwischen wechselnden Beratern. Kontinuität schafft Vertrauen.

Für wen sind wir der richtige Partner?

Mittelstand mit 50–2.000 MA

Unternehmen, die echte Security brauchen - ohne einen DAX-Konzern-Dienstleister zu bezahlen. Festpreis, klarer Scope, ein Ansprechpartner.

IT-Verantwortliche & CISOs

Die intern überzeugend argumentieren müssen - und dafür einen Bericht mit Vorstandssprache brauchen, nicht nur technische Findings.

Regulierte Branchen

KRITIS, Gesundheitswesen, Finanzdienstleister: NIS-2, ISO 27001, DORA - wir kennen die Anforderungen und liefern Nachweise, die Auditoren akzeptieren.

Mitwirkung an Industriestandards

LLM

OWASP · 2023

OWASP Top 10 for Large Language Models

Prof. Dr. Matteo Große-Kampmann als Contributor im Core-Team des international anerkannten OWASP LLM-Sicherheitsstandards.

BSI

BSI · Allianz für Cyber-Sicherheit

Management von Cyber-Risiken

Prof. Dr. Matteo Große-Kampmann als Mitwirkender des offiziellen BSI-Handbuchs für die Unternehmensleitung (dt. Version).

Your DORA experts

Our certified consultants know the regulatory requirements of the financial sector.

Chris Wojzechowski
Chris Wojzechowski

Geschäftsführender Gesellschafter

E-Mail
PGP 465C26E1AF161AFA

Geschäftsführender Gesellschafter der AWARE7 GmbH mit langjähriger Expertise in Informationssicherheit, Penetrationstesting und IT-Risikomanagement. Absolvent des Masterstudiengangs Internet-Sicherheit an der Westfälischen Hochschule (if(is), Prof. Norbert Pohlmann). Bestseller-Autor im Wiley-VCH Verlag und Lehrbeauftragter der ASW-Akademie. Einschätzungen zu Cybersecurity und digitaler Souveränität erschienen u.a. in Welt am Sonntag, WDR, Deutschlandfunk und Handelsblatt.

IT-Grundschutz-Praktiker (TÜV) IT Risk Manager (DGI) § 8a BSIG Prüfverfahrenskompetenz Ausbilderprüfung (IHK)
Vollständiges Profil ansehen
Jan Hörnemann
Jan Hörnemann

Chief Operating Officer · Prokurist

E-Mail
PGP A3FD64BB96C888E2

M.Sc. Internet-Sicherheit (if(is), Westfälische Hochschule). COO und Prokurist mit Expertise in Informationssicherheitsberatung und Security Awareness. Nachwuchsprofessor für Cyber Security an der FOM Hochschule, CISO-Referent bei der isits AG und Promovend am Graduierteninstitut NRW.

ISO 27001 Lead Auditor (PECB/TÜV) T.I.S.P. (TeleTrusT) ITIL 4 (PeopleCert) BSI IT-Grundschutz-Praktiker (DGI) Ext. ISB (TÜV) BSI CyberRisikoCheck CEH (EC-Council)
Vollständiges Profil ansehen

Affected organisations

Who does DORA apply to?

DORA applies to all financial entities per Art. 2 DORA and to critical ICT third-party providers. We support all affected entity types with tailored consulting offerings.

Banks & Credit Institutions

Since 17 January 2025 all credit institutions - from major banks to cooperative banks - are subject to the full DORA requirements. Particularly critical: the third-party register obligation and TLPT for systemically important institutions.

Art. 2(1)(a) DORA

Insurance Companies

Insurance undertakings and reinsurers are fully captured by DORA. Alongside ICT risk management, requirements on engaging ICT third-party service providers and incident reporting to the competent authority are practically relevant.

Art. 2(1)(c) DORA

Investment Firms

Investment firms and trading venues regulated under MiFID II fall under DORA. The overlap with MiFID II operational resilience and the Market Abuse Regulation requires a coordinated compliance approach.

Art. 2(1)(b) DORA

Payment Service Providers

PSPs, e-money institutions, and payment system operators are particularly exposed: high transaction volumes, real-time settlement requirements, and distributed ICT architectures increase the risk profile.

Art. 2(1)(e/f) DORA

ICT Third-Party Providers

Cloud providers, data centre service providers, and software vendors classified as critical ICT third-party service providers are subject to their own DORA supervisory obligations. We support preparation for supervisory reviews.

Art. 31 ff. DORA

Asset Managers & Fund Administrators

AIFMs and investment management companies are captured by DORA and face the challenge of systematically capturing their often heterogeneous ICT landscapes. We bring experience from comparable ISMS projects in the financial sector.

Art. 2(1)(d) DORA

Combine DORA intelligently

DORA compliance does not exist in a silo. These services complement your DORA programme and create synergies that significantly reduce the overall effort.

Art. 24-27 DORA

Penetration Testing

Every DORA-obligated financial entity must conduct annual resilience tests. Our certified penetration testers conduct Art. 25-compliant tests - including TLPT per TIBER-EU for systemically important institutions.

Request penetration test Synergy with DORA

ISMS ISO 27001

An existing ISO 27001 ISMS significantly reduces DORA implementation effort. Conversely, DORA-compliant ICT risk management strengthens ISO 27001 certification. We develop a combined implementation roadmap.

Request ISO 27001 consulting Parallel obligation

NIS-2 Compliance

Many financial entities are simultaneously subject to DORA and NIS-2. The requirements overlap considerably - particularly on incident reporting and third-party management. We maximise synergies and avoid duplicate work.

Request NIS-2 consulting

Referenzen aus der Praxis

Beratung Informationssicherheit

brainbits GmbH

Ausbau und Begleitung des ISMS zur ISO 27001 Zertifizierung

9

Monate bis zur Zertifizierungsreife

70

Mitarbeitende im Team

Pentesting & Schwachstellenscans

Institut für Verwaltungswissenschaften gGmbH

Externe Schwachstellenanalyse

Frequently asked questions about DORA consulting

Answers to the most common questions about our DORA consulting offering, the process, and costs.

A complete DORA gap analysis typically takes 5-10 working days, depending on the size of the organisation, the number of ICT systems, and the scope of existing ICT risk management. The result is a prioritised action plan with effort estimates and a realistic implementation roadmap. We provide a transparent fixed-price quote - no open consultant days.
Yes. AWARE7 conducts Threat-Led Penetration Tests per the TIBER-EU framework. Our OSCP-certified penetration testers are experienced in demanding red-team operations against complex financial infrastructure. We coordinate the entire TLPT process: from alignment with the supervisory authority through the threat intelligence phase to the final report. For initial TLPTs we recommend a lead time of at least 6 months.
Yes. We support the complete construction of the ICT third-party register per Art. 28 DORA: capturing all ICT service providers, criticality classification, contract analysis against DORA minimum requirements, and identification of concentration risks. We also review existing contracts for DORA compliance and create template clauses for new contracts meeting DORA minimum requirements per Art. 30.
Costs depend on scope, organisational size, and existing maturity level. We work on a fixed-price basis - after the initial gap analysis we can calculate all further services concretely. For an initial orientation: a gap analysis for a mid-sized financial institution typically falls between EUR 8,000 and EUR 20,000. Contact us for an individual quote.
An existing ISO 27001 ISMS is an excellent foundation for DORA compliance and significantly reduces the implementation effort. Many DORA requirements on ICT risk management (Art. 5-16) are already covered by an ISO 27001 ISMS. The DORA-specific requirements - particularly the third-party register, TLPT, the 4-hour reporting obligation, and the financial sector-specific contract clauses - are however additional elements that must be implemented in any case.
Yes. Setting up incident classification and reporting processes that ensure the 4-hour initial notification and 72-hour deadline is part of our DORA consulting services. We develop pragmatic escalation matrices, reporting templates meeting EBA RTS requirements, and train your teams on the new processes. Optionally we implement SIEM integration for automated initial detection of major ICT incidents.

Aus dem Blog

Weiterführende Artikel

Request DORA consulting

We will prepare a transparent fixed-price quote for your DORA gap analysis within 24 hours - straight to the point.

Book a free initial consultation

Kostenlos · 30 Minuten · Unverbindlich