What does the CFO decide first: which DORA role does the company have?
| Role | What to do |
|---|---|
| EU financial entity (including subsidiaries established in the EU) | ICT risk management framework, major incident reporting, resilience testing, third-party risk management and the register of information |
| ICT third-party service provider to financial entities | Meet Article 30 contract clauses, provide register information, support incident handling and testing, prepare exit arrangements |
| Designated critical ICT third-party service provider | Direct oversight by the lead overseer |
The first list of 19 critical ICT third-party service providers, published on 18 November 2025, includes no Taiwanese company.
If an EU financial client asks us to sign DORA clauses, what contractual responsibilities and costs follow?
Under Article 30, the clauses the client must include cover the service description, where services are provided and data processed, assistance with ICT incidents, cooperation with authorities and termination rights; where critical or important functions are supported, they add service levels, business continuity plans and testing, audit rights and an exit strategy. The client must also record your service in its register of information (providers outside the EU are identified by LEI).
The CFO should estimate the ongoing cost these clauses bring, and the data and service transfer arrangements on exit. Where a legal opinion on contractual liability or jurisdiction is needed, consult a lawyer.
How large is the penalty exposure? Is DORA 2% of worldwide annual turnover?
No.
- Financial entities: DORA sets no turnover-based fines; penalties are set by each member state in national law under Article 50
- Critical ICT third-party service providers: the lead overseer may impose periodic penalty payments under Article 35, daily, for up to 6 months, of up to 1% of average daily worldwide turnover in the preceding business year
- Providers not designated as critical: generally no direct DORA obligations; requirements reach you through client contracts
The commonly quoted "2%" is the NIS2 Article 34 rule for essential entities, which under NIS2 Article 4 does not apply to DORA financial entities.
What extra operating cost do the major ICT incident reporting deadlines create for a provider?
Under Delegated Regulation (EU) 2025/301:
- Initial notification: within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it
- Intermediate report: within 72 hours of the initial notification
- Final report: within 1 month of the latest intermediate report
The financial entity carries the reporting obligation, but clients will require ICT providers to assist with incidents and provide information under the contract. The CFO should confirm that incident-handling staff and on-call arrangements, and the scope of contractual assistance obligations, are reflected in the budget and service levels.
Is there a DORA certificate? How much can existing ISO 27001 or business continuity systems save?
DORA has no standalone certificate. Organisations with an ISO 27001 or business continuity management base can reuse existing documents and controls, noticeably shortening the timeline, rather than building a second system.
Also, if you do not serve EU financial entities, or a client only asks for a security questionnaire and not for DORA contract clauses, answering with your existing ISO 27001 system and records is usually enough — the CFO's first checkpoint against over-investing.
Timeline: how long does DORA preparation take?
As listed on the service page:
- Preparing an ICT provider's contractual obligations: usually 2–3 months
- A full DORA framework for a financial institution: usually 6–9 months
- Noticeably shorter with an ISO 27001 or business continuity management base
The full framework has five steps: applicability and scope, the ICT risk management framework, the incident reporting SOP, third-party ICT risk management, and TLPT planning with ongoing resilience testing.
How does Winners Consulting help a CFO with DORA?
- VP- and director-level consultants lead the work end to end, never outsourced
- We first determine whether you are a financial entity or an ICT provider, and confirm the scope of contractual obligations and how ready the Register of Information input is
- A gap analysis against the DORA framework and chapter-by-chapter system documents, including an incident reporting SOP with initial notification within 4 hours of classification as major
- TLPT applicability assessment and integrated DORA + NIS2 assessment; existing ISO 27001 or business continuity documents and controls are reused
Read more: DORA compliance, Choosing a DORA consultant, ISO 22301 business continuity, CFO role page. Request a free mechanism diagnosis
How other roles see this service
Other services for this role
- CFO implementing ERM: what to prepare for board reports, annual report risk items and the ESG evaluation
- CFO view of ISO 27001: annual report cybersecurity disclosure, ESG bonus points and budgeting
- CFO implementing ISO 37001: financial controls, integrity disclosure and cross-border bribery exposure
- CFO view of trade secrets and ISO 56001: protecting R&D value and earning ESG bonus points
- CFO implementing ISO 22301: disruption losses, RTO investment and budgeting
- CFO view of GDPR and ISO 27701: fine provisions, cross-border transfers and budgeting
- CFO view of the EU CRA and EU AI Act: EU revenue risk, penalties and budgeting
- NIS2 for CFOs: fine caps, management liability and provisions
- Digital transformation for CFOs: budget, ROI and capitalisation
- AI transformation for CFOs: ROI, penalty exposure, capitalisation
Official sources
- Regulation (EU) 2022/2554 DORA（EUR-Lex）
- Commission Delegated Regulation (EU) 2025/301：incident reporting time limits（EUR-Lex）
- Commission Implementing Regulation (EU) 2024/2956：register of information templates（EUR-Lex）
- ESAs：designation of critical ICT third-party providers（18 November 2025）
- Directive (EU) 2022/2555 NIS2（EUR-Lex）