DORA Compliance Support

Practical help with the Digital Operational Resilience Act, from gap analysis to the resilience testing it requires.

The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, has applied since 17 January 2025. It sets out how financial entities in the EU must manage ICT risk, report major incidents, test their digital operational resilience and manage the risk from their ICT third-party providers.

UK businesses are affected too: the EU-regulated subsidiaries and branches of UK groups fall within scope, and UK technology suppliers to EU financial entities are increasingly asked to support their customers' DORA obligations through contracts, due diligence and testing. Samurai Security helps you understand what DORA means for you and provides the testing and evidence to support it.

Discuss DORA Support

Book a Gap Analysis

Two colleagues looking at a computer screen

What Does DORA Require?

DORA is built around five areas: ICT risk management, ICT-related incident management and reporting, digital operational resilience testing, ICT third-party risk management, and information sharing.

For testing, financial entities other than microenterprises must maintain a risk-based testing programme and make sure that appropriate tests are carried out at least yearly on all ICT systems and applications supporting critical or important functions. The regulation lists the kinds of tests expected, including vulnerability assessments and scans, network security assessments, source code reviews where feasible, scenario-based tests and penetration testing. Financial entities identified by their competent authority must also carry out threat-led penetration testing (TLPT) at least every three years. The detailed TLPT requirements, including how entities are identified, the testing phases and the requirements for testers, are set out in Commission Delegated Regulation (EU) 2025/1190, in force since 8 July 2025.

Why Act on DORA Now?

DORA is in force, and supervisors expect firms to show evidence that its requirements are working in practice, not just written into policy. Testing findings must be prioritised, classified and remediated, and contracts with ICT providers must support the firm's own obligations.

For suppliers, being able to show strong security, recent independent testing and a clear incident response process makes due diligence faster and helps you win and keep financial services customers.

How We Help

DORA gap analysis

A review of your current ICT risk management, incident management, testing and third-party arrangements against DORA's requirements, with a prioritised plan to close the gaps.

Resilience testing programme

Help designing a risk-based testing programme proportionate to your organisation, and delivery of the testing itself: vulnerability assessments, penetration testing of infrastructure, web applications, APIs, mobile and cloud, and secure code review.

Scenario-based and red team testing

Scenario-based exercises and red team testing that show how your organisation would cope with a realistic attack. We can help you prepare for TLPT, which has its own requirements under Delegated Regulation (EU) 2025/1190. Samurai Security does not claim to be a TLPT provider.

Incident response readiness

Review of incident classification and reporting processes, incident response plans and tabletop exercises to test them.

ICT third-party risk

Assessment of your ICT providers' security and support with the information and assurance your own customers ask for.

Policies and governance

Review and development of the ICT risk management policies and procedures DORA expects, with virtual CISO support where you need ongoing leadership.

Our Approach

Door handle with a keypad lock on a wooden door

01

Scoping

We confirm whether and how DORA applies to you, whether as a financial entity or as an ICT supplier, and agree the scope of support.

02

Gap analysis

We review your current position against the relevant DORA requirements and agree priorities with you.

03

Remediation and testing

We deliver the agreed testing, reviews and policy work, at £1,350 per consultant day, and support your teams with the fixes.

04

Report and debrief

You receive clear reports that can support your evidence for management and supervisors, and we talk your team through every finding.

Why Choose Samurai Security?

CREST-accredited testing

Our penetration testing is delivered by a CREST-accredited team.

01

NCSC Assured Cyber Security Consultancy

Samurai Security is an NCSC Assured Cyber Security Consultancy for Risk Management, so our gap analysis and governance advice is grounded in recognised good practice.

02

Testing and governance in one place

From policy and third-party risk to penetration testing and incident response exercises, we cover the practical work DORA requires.

03

Our Work

Aerial view of a residential housing estate

Strengthening Cybersecurity Resilience

“Samurai takes the time to understand our needs and helps us to be an enabler for Flagship Group’s mission. It’s always a pleasure to work with them and I’d recommend them to others.”

Enabling Remote Work for the NHS

“When I have a problem nobody else can solve, I call Samurai because I know that they’ll deliver what I need, every time, without fail.”

Incident Response Retainers To Enable Growth

“This partnership has allowed us to scale and grow with the confidence that we are protected from cyber threats around the clock.”

Client Testimonials

“Samurai takes the time to understand our needs and helps us to be an enabler for Flagship Group’s mission. It’s always a pleasure to work with them and I’d recommend them to others.”

“We were astonished by what Samurai’s Black Dragon assessment revealed, even though we thought we had everything covered. The findings spoke for themselves, and the team’s expertise and clarity were outstanding.”

"Samurai’s Black Dragon: Attack Surface Risk Assessment was exactly what we needed and something we’ve never seen done before. They turned it around quickly, highlighted risks that could have easily been overlooked, and gave us a clear roadmap for improvement."

Frequently Asked Questions

Does DORA apply to UK firms?

DORA is an EU regulation. It applies to financial entities regulated in the EU, which can include EU subsidiaries and branches of UK groups. UK suppliers of ICT services to EU financial entities are not usually regulated directly, but are often required by contract to support their customers' DORA obligations. The exception is a provider designated as a critical ICT third-party provider (CTPP) by the European Supervisory Authorities: CTPPs are overseen directly under DORA, and a CTPP based outside the EU must set up an EU subsidiary within 12 months of designation. We can help you work out where you stand, but you should confirm your legal position with your advisers.

What testing does DORA require?

Financial entities other than microenterprises must run a risk-based testing programme and test the ICT systems and applications supporting critical or important functions at least yearly. Tests can include vulnerability assessments, network security assessments, source code reviews, scenario-based tests and penetration testing. Financial entities identified by their competent authority must also carry out threat-led penetration testing (TLPT) at least every three years.

Can you carry out TLPT under DORA?

TLPT is run under arrangements set by each competent authority, following Commission Delegated Regulation (EU) 2025/1190, and testers must meet the requirements in Article 27 of DORA. Samurai Security does not claim to be a TLPT provider. We can help you prepare for TLPT and carry out scenario-based and red team testing, and we'll be clear with you about how that relates to any formal TLPT.