DORA, evidenced rather than asserted
Financial entities have been in scope since January 2025. The register of ICT third-party providers, the incident classification and the resilience testing are the artefacts that get requested.
Case studies
Business services
Firms whose entire asset is client confidence and client data — financial, legal, accounting and technology businesses — usually holding far more sensitive material than their IT arrangements would suggest. The work is to make the security real and provable without building a department to do it.
Book a 30-minute executive briefing- Relevant regulation or standard
- DORA, for financial entities
- Relevant regulation or standard
- PCI DSS where cards are taken
- Relevant regulation or standard
- GDPR
- Relevant regulation or standard
- Professional secrecy and privilege obligations
- Relevant regulation or standard
- EU AI Act
Who we work with
Managing partner or owner
Holds client confidences and has no IT function to speak of.
COO of a financial or payments firm
Is inside DORA and has to evidence it rather than assert it.
Founder or COO of a technology company
Is being asked diligence questions faster than the processes exist to answer them.
Compliance officer
Answers client and regulator questions about arrangements they do not control.
The data is worth more than the infrastructure protecting it
A twelve-person legal practice, a payments firm and a growing software company look like very different businesses, and on this one dimension they are identical: the value is client confidence, the material they hold is disproportionately sensitive relative to their size, and the IT arrangements protecting it were assembled as the business grew rather than designed. Attackers understand this better than most boards do — the professional firm is not a smaller target, it is a softer route to larger ones.
For financial and payments firms the obligation is explicit. DORA has applied since January 2025 across the financial sector, including payment and e-money institutions, and it is unusually specific: ICT risk management, incident classification and reporting, resilience testing, and a register of your ICT third-party providers with contractual requirements to match. It is not a policy exercise — the register and the testing evidence are the things that get asked for. Where cards are involved, PCI DSS sits alongside it.
For professional practices the obligation is quieter and the exposure is not. Most law firms, accountants and notaries fall outside NIS2, which is regularly misread as falling outside the problem. Professional secrecy, GDPR and a duty to clients all still apply, insurers ask harder questions every renewal, and the realistic threat is unglamorous: invoice fraud and business email compromise around completion payments, where the money moves once and does not come back.
For technology companies the pressure arrives commercially. The third client security questionnaire in a quarter, an investor's diligence, or a tender that asks where data is hosted and under which jurisdiction. The answers exist informally and informally does not pass — and at that stage hiring an IT function is slower and more expensive than buying one.
Common to all three: AI arrived in the work before any policy did. Drafting, summarising, research, reconciliation, client correspondence. The constructive response is an approved route and a fast approval, because a prohibition in a firm whose people are under billing pressure simply moves the usage onto personal accounts, where the confidentiality exposure is real and invisible.
What bites here
Professional secrecy with consumer-grade IT
Privileged material in ordinary mailboxes and file shares, with access that has never been reviewed. The obligation is professional rather than statutory, and it is no less enforceable for that.
Payment and invoice fraud
Business email compromise around completion and settlement payments is the realistic loss event for practices, and it is prevented by process and verification rather than by a product.
Diligence as the actual regulator
For technology firms, client questionnaires and investor diligence set the bar long before any law does — and they arrive with commercial deadlines attached.
AI already in the drafting
Client material in consumer AI tools, without a policy, because the work is faster that way. An approved route with a quick approval is the only version of this that works.
What we do here
Evaluate
Establish what you hold, where it is, and what the obligation actually is for this firm.
Plan
A target state proportionate to a firm of your size, not a bank's.
Enable
The people are the control surface in a professional firm.
Build
Certifiable where it earns work, and hosted where you can name the jurisdiction.
Operate
Buy the function rather than building the department.
Where this usually starts
For financial and payments firms, with the DORA position — specifically the third-party register and the incident classification, because those are the two things a supervisor or a client asks to see and the two that take longest to assemble retrospectively. For professional practices, with a short assessment covering identity, email, backups and access, plus a working session on AI use, which together address most of the realistic exposure at a cost proportionate to the firm. For technology companies, with whichever question is blocking a deal: usually hosting and jurisdiction, and usually answerable in weeks. In all three cases the second conversation is the same one — whether to build an internal function or buy it, and the case study below is one company's answer.
Questions
We are a small practice. Is ISO 27001 realistic for us?
Sometimes, and it is often not the right first step. Certification pays for itself when clients or tenders ask for it. If nobody is asking, the same money spent on identity, email security, tested backups and access reviews reduces more risk. We will tell you which situation you are in before you commit.
Does DORA apply to us?
If you are a financial entity in the EU it very likely does, and the definition is broad — payment institutions, e-money institutions and many service providers to them are included. The register of ICT third-party providers is the artefact most firms are missing, and it is the one most likely to be requested.
Are we in scope of NIS2?
Most law firms, accountancies and notarial practices are not, and that is frequently misread as being out of scope of the problem. Professional secrecy, GDPR and your clients' own supplier requirements all still reach you, and the last of those has become the practical driver.
Our people are already using AI on client work. What do we do?
Give them an approved route quickly, then write the policy around what they actually need to do. A prohibition in a firm under billing pressure moves the usage onto personal accounts, which converts a manageable exposure into an invisible one. The responsible AI policy engagement is exactly this piece of work.
Can you just run all of it for us?
Yes — hosting, security monitoring and a service desk under one owner, which is what the case study below describes. It suits firms that need the capability and the evidence without building a department, and it is designed to hand over cleanly if you later hire.
Related services
Leave with your top three risks documented
Thirty minutes with a senior practitioner. No slideware, no sales engineer.