DORA Compliance Consulting
DORA has been in force since 17 January 2025. We support financial entities from gap analysis through ICT risk management build-out to the annual penetration test per Art. 25 - all from a single source, transparently priced.
ISO 27001 certified · Fixed-price commitment · DORA expertise since 2024
AWARE7 DORA Services
Regulation
Art. 5-16Service
Gap Analysis & ICT Risk ManagementScope
Complete inventory and action planRegulation
Art. 17-23Service
Incident Management & ReportingScope
Establish 4-hour and 72-hour reporting processesRegulation
Art. 24-27Service
Resilience Testing & TLPTScope
Annual pentests and TIBER-EU red-team testsRegulation
Art. 28-44Service
Third-Party Register & Contract ReviewScope
Build register, check contracts for DORA clausesTrusted by our clients
Our Services
Each DORA requirement demands specific expertise. We cover all five pillars with concrete consulting services - from a single source.
Art. 5-16
Build or extend the ICT risk management framework per Art. 5-16: asset inventory, risk assessment procedures, protective measures, and board-level anchoring. For ISO 27001 organisations: efficient delta mapping to DORA-specific requirements.
Gap analysis · Asset inventory · Risk management framework · Business continuity plan
Art. 17-23
Development and implementation of complete incident classification and reporting processes ensuring the 4-hour initial notification and 72-hour interim report to the relevant authority. Including EBA RTS-compliant reporting templates and escalation matrices.
Classification procedures · 4h/72h reporting processes · Regulatory reporting templates · SIEM integration (optional)
Art. 24-27
Annual penetration tests and vulnerability assessments per Art. 25 DORA for all affected financial entities. For significant institutions: preparation and conduct of Threat-Led Penetration Tests (TLPT) per TIBER-EU with OSCP-certified testers.
Annual penetration tests · Vulnerability assessments · TLPT per TIBER-EU · Supervisory coordination
Art. 28-44
Complete construction of the ICT third-party register per Art. 28: capture all service providers, criticality classification, concentration risk analysis. Contract analysis against DORA minimum clauses per Art. 30 and development of template contract clauses.
Third-party register (Art. 28) · Contract analysis (Art. 30) · Concentration risk analysis · Exit strategy templates
Art. 45
Advisory on DORA-compliant build-out or joining of threat intelligence sharing communities per Art. 45. Data protection-compliant design of information exchange and connection to existing ISACs in the financial sector.
ISAC membership advisory · Data protection-compliant processes · Threat intelligence integration · Confidentiality framework
All Articles
DORA requires the management body to take personal responsibility for ICT risk management and to demonstrate relevant knowledge. We offer compact DORA training for boards and senior management - practical and without unnecessary theory.
DORA overview for executives · Liability scenarios · Supervisory communication · Documentation obligations
Our approach
Structured, transparent, and with clear milestones - this is how we guide you to demonstrable DORA compliance. All steps are calculable on a fixed-price basis.
Duration: 1-2 days
Clarification of your DORA category per Art. 2, scope of applicable requirements, and review of proportionality provisions for your organisation. Result: clear classification and prioritisation.
Duration: 5-10 days
Structured review of all existing ICT risk management measures, incident processes, and third-party contracts against all DORA requirements. Result: prioritised action plan.
Duration: 3-8 days
Complete construction of the ICT third-party register per Art. 28: capture all service providers, classify criticality, review contracts for DORA compliance, identify concentration risks.
Duration: annual / every 3 years
Conduct of annual resilience tests per Art. 25 DORA. For significant institutions: preparation and coordination of the TLPT process per TIBER-EU including alignment with the competent authority.
„DORA is not a paper exercise - supervisors review substantively. Financial entities that equate DORA compliance with a documentation package underestimate the requirements. Our strength is the combination of ISMS methodology and real penetration testing: we build DORA frameworks that can withstand a TLPT examination.“
Oskar Braun
ISO 27001 Lead Auditor (IRCA certified) · AWARE7 GmbH
Why AWARE7
The combination of offensive security expertise and ISMS experience makes AWARE7 unique for DORA mandates - especially for the resilience testing requirements.
AWARE7 has been conducting penetration tests for over 12 years. Our OSCP- and OSWA-certified testers know the attack techniques DORA resilience tests examine - and build your defences accordingly.
OSCP / OSWA / OSWP certificates · Red-team experience · TIBER-EU knowledge · 500+ penetration tests
We are ourselves certified to ISO 27001 and ISO 9001. 20+ ISMS projects supported, all successfully certified, demonstrate our methodology. For DORA this means: no greenfield build, but efficient delta mapping based on existing ISMS structures.
ISO 27001 certified ourselves · 20+ ISMS projects · All projects successfully certified · NIS-2 synergies utilised
Gap analysis, ICT risk management, third-party register, incident processes, and annual penetration tests - all from a single source. No coordination overhead between multiple providers, clear points of contact, consistent quality.
Unified methodology · Fixed-price quotes · 24h to quote · 100% permanent staff experts
Why AWARE7 for DORA consulting
Pure awareness platforms don't test systems. Pure consulting firms are too far removed. AWARE7 combines both: we hack your infrastructure and train your employees: tailored to mid-sized companies, personal, without enterprise overhead.
Around 20% of our revenue comes from research projects for the BSI and the BMBF. Our studies, published at ACM and Springer conferences, analyse millions of websites and tens of thousands of phishing emails. Three of our executives are professors at German universities at the same time.
From first contact to final report, your data is stored on our own servers in Germany - no US cloud providers, no third-country transfers. Our AI also runs on our own hardware in Germany - with locally operated open-source models. Client and project data never reach external AI services. All staff are permanently employed, covered by social insurance and bound by uniform legal obligations.
More on digital sovereigntyWithin 24 hours you receive a binding fixed-price quote without hourly rate risk. A well-practised team and standardised processes ensure a clear schedule with a defined start and end date.
A personal project manager accompanies you from the first meeting to the retest. You book appointments directly with your contact person and keep the same contact throughout the project.
Peer-reviewed publications
Different Seas, Different Phishes - Large-Scale Analysis of Phishing Simulations
ACM AsiaCCS 2025
Oskar Braun, Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
A Platform for Physiological and Behavioral Security
NSPW 2025
Jan Hörnemann
Privacy from 5 PM to 6 AM: Tracking and Transparency in the HbbTV Ecosystem
IEEE/IFIP DSN 2025
Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
Understanding Regional Filter Lists: Efficacy and Impact
PoPETS 2025
Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
Who is AWARE7 the right partner for?
Your DORA experts
Our certified consultants know the regulatory requirements of the financial sector.
Managing Director of AWARE7 GmbH with many years of expertise in information security, penetration testing and IT risk management. Graduate of the Internet Security master's program at Westfälische Hochschule (if(is), Prof. Norbert Pohlmann). Bestselling author with Wiley-VCH and lecturer at the ASW-Akademie. His assessments of cybersecurity and digital sovereignty have appeared in Welt am Sonntag, WDR, Deutschlandfunk and Handelsblatt, among others.
M.Sc. in Internet Security (if(is), Westfälische Hochschule). COO and authorized officer (Prokurist) with expertise in information security consulting and security awareness. Junior professor (Nachwuchsprofessur) for Cyber Security at FOM Hochschule, CISO lecturer at isits AG and doctoral candidate at the Graduierteninstitut NRW.
Affected organisations
DORA applies to all financial entities per Art. 2 DORA and to critical ICT third-party providers. We support all affected entity types with tailored consulting offerings.
Since 17 January 2025 all credit institutions - from major banks to cooperative banks - are subject to the full DORA requirements. Particularly critical: the third-party register obligation and TLPT for systemically important institutions.
Insurance undertakings and reinsurers are fully captured by DORA. Alongside ICT risk management, requirements on engaging ICT third-party service providers and incident reporting to the competent authority are practically relevant.
Investment firms and trading venues regulated under MiFID II fall under DORA. The overlap with MiFID II operational resilience and the Market Abuse Regulation requires a coordinated compliance approach.
PSPs, e-money institutions, and payment system operators are particularly exposed: high transaction volumes, real-time settlement requirements, and distributed ICT architectures increase the risk profile.
Cloud providers, data centre service providers, and software vendors classified as critical ICT third-party service providers are subject to their own DORA supervisory obligations. We support preparation for supervisory reviews.
AIFMs and investment management companies are captured by DORA and face the challenge of systematically capturing their often heterogeneous ICT landscapes. We bring experience from comparable ISMS projects in the financial sector.
Complementary services
DORA compliance does not exist in a silo. These services complement your DORA programme and create synergies that significantly reduce the overall effort.
Art. 24-27 DORA
Every DORA-obligated financial entity must conduct annual resilience tests. Our certified penetration testers conduct Art. 25-compliant tests - including TLPT per TIBER-EU for systemically important institutions.
Request penetration testSynergy with DORA
An existing ISO 27001 ISMS significantly reduces DORA implementation effort. Conversely, DORA-compliant ICT risk management strengthens ISO 27001 certification. We develop a combined implementation roadmap.
Request ISO 27001 consultingParallel obligation
Many financial entities are simultaneously subject to DORA and NIS-2. The requirements overlap considerably - particularly on incident reporting and third-party management. We maximise synergies and avoid duplicate work.
Request NIS-2 consultingReferences
These case studies are available in German.
Frequently asked questions
Answers to the most common questions about our DORA consulting offering, the process, and costs.
Aus dem Blog
Prüfen Sie, ob Ihre Domäne eine security.txt bereitstellt: so erfüllen Sie die CRA-Meldepflicht und erleichtern Sicherheitsforschern den Meldeweg.
Oskar Braun 
Der Hackerangriff auf das Berliner Landesnetz zeigt: Ohne vollständiges Asset-Inventar gibt es kein geordnetes Containment und keine fristgerechte DSGVO-Meldung.
Oskar Braun 
Der Informationssicherheitsbeauftragte ist der Ansprechpartner für Informationssicherheit im Unternehmen. Diese Aufgaben hat er!
Jan Hörnemann We will prepare a transparent fixed-price quote for your DORA gap analysis within 24 hours - straight to the point.
Free · 30 minutes · No obligation
Arturs Nikitins
Initial consultation & needs analysis
Looking for personal advice?
No obligation · Reply within 24h on business days
