DORA

DORA compliance for financial entities.

Map DORA onto your controls, check your ICT contracts and keep the register of information current, supported by our agents. A compliance engineer helps you prepare for the audit.

ICT risk management mapped onto your controls
ICT third-party contracts checked against Article 30
Register of information kept up to date

Book a demo

30 minutes, on your own setup. We show you where you stand with DORA.

Backed by

Hosting in the EU or US

From gap audit to ongoing DORA compliance

Our agents support every step. You make the decisions.

Step 1

Map DORA to your critical functions

Answer a few questions about your type of financial entity, your ICT services and your critical or important functions. GetTeddy sets the scope of your ICT risk framework and maps DORA onto the controls you already have.

DORAAsking a few questionsScope agreed

ICT risk management

Art. 5Governance

Art. 6Risk frameworkScope

Art. 8Identification

Art. 9Protection

Art. 10Detection

Art. 11Response and recovery

Art. 12Backup

Further pillars

Art. 17Incidentsclassify and report

Art. 24Testingresilience testing

Art. 28Third partiesregister and contracts

Art. 45Information sharingoptional

Which type of entity?

Which ICT services?

Which critical functions?

Step 2

See every gap across all five pillars

Our Gap Audit Agent checks your setup against ICT risk management, incident reporting, resilience testing and third-party risk. You start with a clear list of what is missing, each item with an owner.

DORAGap audit runningGaps found

ICT risk management

Art. 5Governance

Art. 6Risk frameworkScope

Art. 8Identification

Art. 9Protection

Art. 10Detection

Art. 11Response and recovery

Art. 12Backup

Further pillars

Art. 17Incidentsclassify and report

Art. 24Testingresilience testing

Art. 28Third partiesregister and contracts

Art. 45Information sharingoptional

Step 3

Contracts and register, supported by our agents

Our Contract Agent checks your ICT contracts against Article 30, and the results feed your register of information. Evidence flows in from your tech stack and lands on the right requirement. Your team reviews and approves.

DORAChecking contractsRegister up to date

ICT risk management

Art. 5GovernancePolicies

Art. 6Risk frameworkScope

Art. 8IdentificationAssets

Art. 9Protection

Art. 10Detection

Art. 11Response and recovery

Art. 12Backup

Further pillars

Art. 17Incidentsclassify and report

Art. 24Testingresilience testing

Art. 28Third partiesregister and contractsRegisterContracts

Art. 45Information sharingoptional

Step 4

Ready for reporting and supervision

Incident classification, reporting steps, your testing plan and management approval come together until every pillar is green. A compliance engineer from our team helps you prepare for the audit.

DORAPreparing for supervisionReady for supervision

ICT risk management

Art. 5GovernancePolicies

Art. 6Risk framework

Art. 8Identification

Art. 9Protection

Art. 10Detection

Art. 11Response and recoveryPlaybook

Art. 12Backup

Further pillars

Art. 17Incidentsclassify and reportClassification

Art. 24Testingresilience testingTest plan

Art. 28Third partiesregister and contractsRegister

Art. 45Information sharingoptional

Why teams start with GetTeddy

The same result, without months of spreadsheets and consultant hours.

	Consultants and spreadsheets	GetTeddy
Contract review	Clause by clause by hand	Checked by the Contract Agent
Register of information	Spreadsheet maintained by hand	Built from your contracts
Evidence	Collected by hand	Collected continuously
ISO 27001 or NIS2	Separate projects	Built on the same controls
Ongoing	Yearly review	Gap audits every week

Questions

Since when does DORA apply?

Since 17 January 2025. Financial entities in the EU must meet the requirements now.

Which contracts does GetTeddy check?

Contracts with ICT third-party service providers. The Contract Agent checks them against Article 30 and shows missing clauses.

We already have ISO 27001. Does that help?

Yes. Many ICT risk management requirements overlap with ISO 27001 controls, and GetTeddy maps them so you only work on the gaps.

Do we still need a consultant?

No. Our agents support every step, and a compliance engineer from our team helps you prepare for the audit.

Where is our data hosted?

In the region you choose, the EU or the US. Your data is kept separate from other customers and encrypted, and GetTeddy does not train AI models on your data.

Ready when you are

Get DORA-ready with GetTeddy.

See where you stand with DORA in a 30-minute demo.

Book a demo