DORA compliance

The Digital Operational Resilience Act, or DORA, is the EU framework for strengthening the digital operational resilience of the financial sector. It applies from 17 January 2025 and introduces harmonised requirements for ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management, information sharing and oversight of critical ICT third-party service providers.

Forvis Mazars in Malta helps financial entities assess, implement and evidence their DORA compliance in a practical and proportionate way. We support clients across governance, risk management, cybersecurity, ICT controls, third-party arrangements, incident response, testing, reporting and remediation planning, with a focus on operational resilience rather than documentation alone.

How we can help

We provide practical support across the DORA compliance lifecycle, including:

• DORA gap assessments and implementation roadmaps — assessing current arrangements against DORA, applicable RTS/ITS and supervisory expectations, and prioritising remediation actions.
• ICT risk management and governance — reviewing governance, management-body oversight, ICT risk frameworks, policies, controls, roles, reporting lines, ICT asset inventories and risk documentation. Incident management and reporting — supporting incident classification, escalation, communications, evidence capture and reporting processes aligned with DORA reporting requirements, templates and time limits.
• Digital operational resilience testing — assisting with testing programmes, vulnerability assessments, scenario testing, and remediation tracking.
• ICT third-party risk management — reviewing ICT service provider arrangements, critical or important functions, subcontracting risk, contractual provisions, exit planning and ongoing monitoring controls.
• Internal audit support - provision of co-sourcing services to existing internal audit functions with technical expertise on the various DORA requirements.
• Board and management reporting — preparing concise reporting for senior management and boards on DORA readiness, key risks, remediation progress and evidence of compliance.

Why DORA matters now

DORA has moved from implementation planning to ongoing supervisory reality. The ESAs have made clear that there is no transitional period and that financial entities are expected to identify and address gaps in a structured and timely way.

Recent supervisory publications also reinforce the need for strong third-party oversight, effective outsourced-service monitoring and coordinated incident response. The ESAs’ first annual report on major ICT-related incidents under DORA highlighted increasingly borderless and interconnected ICT risks, while also pointing to the importance of robust third-party risk management and cybersecurity controls in light of evolving AI-enabled threats.

Our approach

Our approach is practical, risk-based and evidence-led. We help clients translate DORA requirements into operating procedures, control frameworks, reporting processes and governance routines that can be embedded into day-to-day business operations.

We combine IT assurance, cybersecurity, regulatory compliance, internal controls, risk management and audit experience to help clients prepare for supervisory engagement, strengthen operational resilience and maintain a clear record of compliance activity.

Need support with DORA compliance?

Speak to our IT assurance and risk consulting specialists to assess your DORA compliance position, strengthen your ICT risk and third-party risk frameworks, and prepare clear evidence for management, boards and supervisors.