DORA implementation tool

Automate risk assessment and create treatment plans in accordance with the DORA regulation.

Schedule a demo

Trusted us

How to implement DORA?
9 simple steps with the support of RIG DORA

Act according to the plan that the DORA implementation tool will guide you through. RIG is your organisation’s DORA compliance and security management hub. It will organise your activities in 9 simple steps divided into stages, most of which you will do in the RIG itself.

STEP 1

Risk assessment and planning

In RIG DORA you analyse, assess and plan in an automated way. You perform an ICT risk assessment of the financial institution and prepare a risk handling plan – so you know how to proceed with the implementation of DORA and start the Deming-PDCA cycle.

Surveys and contracts with ICT suppliers

RIG DORA sends automatically prepared surveys to suppliers. In parallel to the risk estimation, you can start collecting surveys from suppliers and verifying contracts with ICT suppliers.

Register of information on contracts with ICT suppliers

In RIG DORA, you register each document. In this step, you draft annexes to contracts and negotiate them.

STEP 2

Implementation of risk treatment plans

With the plans prepared in step 1, you now begin to implement them, including appropriate safeguards and relevant pentesting, followed by training.

Implementation of an ICT incident assessment process

At RIG DORA, you prepare a register of incident information for reporting to the regulatory authorities in January 2025.

Risk management framework

In the RIG archive, you prepare documentation of the so-called framework: (ICT risk management, incident management, ICT supplier management). With the plans prepared in advance, you have a strategy properly calibrated for the organisation. As a result, you implement them effectively.

STEP 3

Information sharing

At RIG DORA, you can continuously develop your team’s competencies through training. You build the resilience of your organisation through the risk management knowledge that is transferred between the different departments of your organisation during DORA implementation. RIG DORA organises collaboration and information exchange. (In accordance with Chapter 6 of the DORA Information Sharing Regulation).

Reporting

You report to the management board, supervisory board and regulators.

Gap analysis

You verify compliance based on the prepared processes in RIG DORA. By having repeatable processes stored in the tool, consisting of tasks resulting from the requirements of the DORA regulation, you can see how gaps affect the risk assessment.

See the many dimensions of compliance and risk in RIG

Explore coherent ICT risk management in compliance with DORA. Explore your organisation’s cybersecurity information in one tool, but from multiple angles – information security, business continuity, personal data.
Manage dynamically, assess, plan, analyse!

If you want to learn more about the product, details related to the subscription, price, access or have other questions, register!

Schedule a demo

Pillars of the DORA Regulation

RIG DORA supports you in fulfilling each of the mandatory pillars of the regulation. You will achieve the 4 required areas in full with the tool and streamline the other 2.

ICT risk management

RIG will support you in all activities with the help of automation:

  • Process mapping
  • Asset inventory
  • Risk assessment and analysis​
  • Risk management plans

Reporting of major ICT incidents

Use the prepared registers and carry out activities t.i.e:

  • Incident register
  • Qualification and evaluation
  • Template for reporting to the supervisor

ICT suppliers

Use prepared surveys and records to carry out tasks:

  • Qualification of ICT providers ICT
  • ICT supplier register
  • Risk assessment of ICT suppliers​

Information sharing

Exchange information within the organisation in a simple way, as everything is done through a single platform.

  • RIG risk management training once a month for all users online live and continuous access to recordings of the training delivered.
  • Q&A for users.

Operational digital resilience testing

By integrating RIG with resilience testing tools, you combine data from resilience tests with vulnerabilities. In this way, you fulfil the responsibilities of execution:

  • Penetration tests
  • Vulnerability scanning
  • EPS
  • VS&M
  • SIEM
  • FW
  • XDR
  • DLP

You gain detailed risk measurement.

Risk management framework

Use the RIG DORA document repository and provide access to the risk management framework to all stakeholders.

Policies, procedures and records are structured and linked to the workflow.

Reporting

Internal and external reporting is very important and is the responsibility of the organisation. As you strive for the goal of accountability, generate in RIG DORA:

  • Analytical reports
  • Workflow – check the progress of the work.
See how each of  the DORA pillars can be managed in the RIG DORA module
Schedule a demo

FAQ

Do ICT incidents impact risk?

Yes, ICT incidents have a significant impact on risk in organisations. An increase in the number of incidents increases the probability of events occurring. In addition, each individual ICT incident, regardless of its nature, can increase overall operational and strategic risk.

How do ICT incidents affect risk?

Incidents can lead to business interruptions, which can disrupt an organisation’s daily operations. These interruptions can generate financial losses and affect the ability to meet obligations to customers.

  • The loss or breach of personal data can lead to serious legal and financial consequences, including fines imposed by regulators for breaches of regulations such as the GDPR.
  • ICT incidents can negatively impact an organisation’s reputation. Customers and partners may lose trust, which can lead to a loss of customers and a decline in brand value.
  • Following an incident, organisations often have to incur significant costs for investigations, repairing systems and implementing new security features, adding to the financial burden.
  • ICT incidents can expose new security vulnerabilities, which in turn can lead to increased risk in the future if the organisation does not take appropriate action to patch them.

Consequently, identifying and managing the risks associated with ICT incidents is a key element of any organisation’s security strategy.

How to include vulnerabilities in risk assessment?

In RIG DORA and in RIG NIS, you can include vulnerabilities in your risk assessments by connecting via API to penetration testing tools.

Which method of risk assessment is compliant with the DORA regulation?

DORA does not force one specific risk assessment methodology, but requires it to focus on the value and criticality of assets held and the impact of their loss on business functions. RIG DORA operates within the RED INTO GREEN application, which has an Asset Based Approach risk assessment methodology that is compliant with DORA, as well as GDPR and NIS2.

Does the RIG DORA Module have special functionalities related to the implementation of the DORA regulation?

Yes, the DORA regulation requires risk assessments in the IS and BC domains, so similarly, the RIG DORA module has the relevant functionalities to select the domains. With these, risk assessments can be carried out in individual IS and BC domains.

DORA requires the maintenance of a register of information on contracts with ICT providers and this functionality of the RIG DORA module will be available from September 2024.

When implementing the DORA regulation, should risk knowledge be made available to all involved?

Access to up-to-date knowledge is key to ensuring an organisation’s security. Tools that provide a view of the organisation in terms of its assets, processes, vulnerabilities and security are helpful. The RIG DORA Module gives an overview of all the information mentioned at general and specific levels and allows all analyses, plans and reports to be updated in an automated manner.

Do ICT providers need to have a different approach to implementing DORA than financial entities?

ICT providers must consider GDPR compliance and must prepare themselves to complete surveys provided to them by financial institutions. ICT providers do not need to create a register of their sub-suppliers, but critical or essential functions ICT providers must demonstrate information about their suppliers and sub-suppliers.

What if you need to prepare for a re-audit in future years and take care of the data update requirements?

What if you need to prepare for a re-audit in future years and take care of data update requirements?

In the case of data updates, working manually, you will need to check all assets, processes, vulnerabilities and security each time. With RIG DORA, all you have to do is create a report and check the current state with it. It is not necessary to map the organisation from the beginning. Once you have verified the changes, simply enter them into the system and generate a new report.

Does the RIG DORA Module meet specific local requirements?

Depending on the market, we provide detailed information on request.