DORA compliance, from regulation to systems

No, and nobody can: there is no DORA certification. Compliance remains the responsibility of the financial entity and its management body, and is verified by the supervisory authority. AtWorkStudio implements and runs the technical measures and produces the evidence (configurations, logs, test results) that the entity brings to audits and inspections.

Regulation (EU) 2022/2554 has applied since 17 January 2025 to the financial entities listed in Article 2: credit institutions, investment firms, management companies, payment and e-money institutions, insurance and reinsurance undertakings, pension funds, crypto-asset service providers and others. For some smaller entities, Article 16 provides a simplified ICT risk management framework. IT companies serving these entities are not directly subject to DORA, but receive its requirements through their contracts.

The contractual provisions of Article 30 (service description, data processing locations, service levels, assistance during incidents, audit rights, termination and exit strategy) and the information the entity must enter in its register of information, including the subcontracting chain. Direct oversight by the European authorities only applies to providers designated as critical: the first list, published by the ESAs on 18 November 2025, has 19 providers. AtWorkStudio also helps IT companies prepare credible answers and technical measures.

Under Delegated Regulation (EU) 2025/301: initial notification within 4 hours of classifying the incident as major and in any case within 24 hours of becoming aware of it, intermediate report within 72 hours of the initial notification, final report within one month of the latest intermediate report. Reporting is the entity’s duty; AtWorkStudio provides the technical data needed to classify the incident and complete the reports.

Alerts are analysed by the AtWorkStudio team during business hours. Out of hours, automation takes over: it isolates the device, blocks the compromised account, stops malicious processes and notifies the contacts designated by the entity. For entities that need to be able to classify an incident out of hours, on-call availability and extended coverage are defined in the contract, together with the escalation procedure to whoever decides on classification and reporting.

Threat-led penetration testing (TLPT, Article 26) is only required of entities identified by the authority, at least every three years, and must be carried out by testers meeting the requirements of Article 27. AtWorkStudio runs vulnerability assessments, penetration tests and recovery tests, prepares the environment for TLPT and implements the fixes that come out of it.

For the financial sector, DORA is the sector-specific law and takes precedence over NIS2 for ICT risk management and incident reporting. Many technical measures are shared (backup, identity management, detection, supplier management), so a group with companies in both scopes can run a single technical programme.

No. ISO/IEC 27001 covers much of ICT risk management, but DORA adds its own obligations: incident classification and reporting with fixed deadlines, a resilience testing programme, a register of information on ICT providers, mandatory contractual provisions. AtWorkStudio’s management system, certified to ISO/IEC 27001, 27017, 27018 and ISO 9001, is a solid basis for the due diligence the entity carries out on us.