Services · Cyprus
DORA readiness for Cyprus and EU financial firms: ICT risk, incident response, third-party oversight and resilience testing.
Published Updated
Tetramatrix helps financial organisations in Cyprus assess, implement and evidence digital operational resilience under the Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554. DORA has applied since 17 January 2025. The work is tailored to the legal entity, activities, size, risk profile and supervisory context. It can include a readiness review, practical implementation support, resilience testing and independent security assessment for eligible, authorised scopes. See the official regulation on EUR-Lex.
DORA duties vary by entity type and legal status. We work with the organisation’s management, ICT, risk, compliance and legal teams to identify the applicable requirements and evidence expected for their situation. The service supports CySEC-regulated firms and other EU financial entities; it does not replace legal advice or a decision by the competent authority. Where an entity may qualify for a simplified ICT risk-management framework, eligibility must be checked against its exact classification and applicable rules.
“The management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework.”
Regulation (EU) 2022/2554, Article 5(2)
We begin by understanding your services, important business functions, technology environment, ICT suppliers, existing controls and supervisory context. This gives the engagement a practical boundary: which DORA obligations apply, what is already operating, where evidence is missing and which changes carry the greatest risk. The assessment produces a clear view of gaps, dependencies, owners and recommended priorities rather than a generic checklist.
The review can map governance and accountability, ICT risk management, information-security policies, asset classification, access controls, incident handling, continuity and recovery, resilience testing and third-party ICT risk. We also identify how current procedures and technical controls can be evidenced, who approves them and how they will be reviewed over time.
We can help establish or improve an ICT risk-management framework that fits the entity’s obligations and operating model. Work can include ICT and information-security policies, roles and responsibilities, a classified asset inventory, service and supplier dependencies, business-impact considerations, a risk register and treatment plans for material exposures. Evidence can be linked to the control and accountable owner so management can see what is implemented, what remains open and what must be reviewed.
For digital services, the inventory may span production infrastructure, applications, APIs, data stores, identity systems, cloud services and relevant external integrations. We help the team record key dependencies and access boundaries, identify critical or important functions and connect technical risks to business impact. The scope and depth of the registers are agreed with the organisation, including proportional treatment for its size and profile.
An incident process needs to work under pressure and produce reliable records. We can help define event capture, severity and classification criteria, escalation paths, response ownership, communications, containment and recovery steps, and the evidence retained for each event. The process can include templates for recording impact, affected services, timeline, decisions and lessons learned.
We also help prepare reporting workflows so the right people can assess whether an incident meets applicable reporting thresholds, assemble required information and route it through the organisation’s approval process. Timelines and notification duties depend on the applicable rules and incident classification; these should be validated by the entity’s compliance or legal advisers. Exercises can test that technical teams, management and communications contacts understand their roles before an incident occurs.
Resilience planning connects technology recovery to essential business services. Depending on scope, we can help document a digital operational resilience strategy, business continuity and disaster recovery plans, recovery objectives, backup arrangements, crisis communications and service restoration priorities. Plans should identify who makes decisions, how dependencies are handled and how the organisation will continue or recover when primary systems or suppliers are unavailable.
Testing can include backup restoration, recovery walkthroughs, tabletop exercises and technical validation. We can help define the objectives, evidence and follow-up actions, then track findings through remediation. The aim is to demonstrate that critical capabilities can be restored in practice and that staff know how the response works.
Financial entities depend on cloud, software, hosting, security and operational providers. We can help maintain an ICT third-party register, record which services support important functions, assess provider risks and identify dependencies or concentrations that deserve attention. The review can include due-diligence evidence, oversight ownership, service continuity considerations and the information needed for management review.
Where requested, we can help technology and procurement teams review ICT contract requirements against the organisation’s DORA obligations, prepare a structured list of clauses or evidence to resolve and maintain follow-up actions with each provider. Legal advisers should review and approve contract wording. The organisation remains responsible for its third-party governance and for decisions about whether a provider and arrangement are acceptable.
Digital operational resilience testing should reflect the organisation’s risk, systems and applicable regulatory requirements. We can help shape a proportionate testing plan covering vulnerability assessments, external PCI ASV scans where relevant, penetration testing, recovery validation and follow-up of findings. The plan identifies systems, dependencies, test windows, safety limits, owners and evidence so testing results feed back into risk treatment.
Authorised penetration testing can be scoped across network and infrastructure exposure, TLS and security headers, web applications, APIs, authentication and sessions, client-side behaviour, integrations and webhooks, software dependencies and dynamic application testing. Performance or resilience exercises may be included when they are agreed, safe and relevant. We document written authorisation, rules of engagement, emergency contacts, exclusions and reporting expectations before the test; production testing is never treated as an open-ended scan.
For a related PCI external scan service, see our PCI ASV scanning service. ASV scanning and penetration testing answer different questions and are scoped separately.
Implementation should leave the organisation with usable records. Deliverables can include a DORA gap assessment, risk register, ICT asset inventory, resilience strategy, incident procedures, continuity and recovery plans, third-party provider register, testing programme, remediation tracker and management evidence pack. We can also support the preparation of self-assessment responses and submissions by mapping answers to documented controls and evidence supplied by the client.
Evidence is grounded in the entity’s actual systems and approved procedures. We distinguish planned work from implemented controls and record open actions rather than presenting incomplete measures as finished. The organisation’s management body retains ownership of risk acceptance, governance decisions and the final compliance position.
Our DORA consulting is delivered from Cyprus for local financial organisations, including firms supervised by CySEC, and can support in-scope EU entities remotely. We work with fintech and payment businesses, investment firms, insurers and other financial entities where the regulation applies. The first step is confirming the correct legal entity and regulatory scope, because not every technology company or service provider has the same direct obligations.
Whether you need a focused gap assessment, an implementation programme or a combined compliance and security-testing engagement, Tetramatrix can help turn DORA requirements into assigned work, tested processes and evidence your organisation can maintain.
DORA applies to defined financial entities in the EU, with requirements and exemptions depending on the legal entity and its activities. We help Cyprus-based financial firms, payment and e-money institutions, investment firms, insurers and in-scope crypto-asset service providers assess their position with their compliance and legal advisers.
We review the applicable requirements against your governance, ICT risk controls, assets, incident processes, resilience testing and ICT third-party arrangements. The output is a documented gap assessment with prioritised actions, owners and evidence needs.
Yes. Depending on the agreed scope, we can help develop or improve policies, risk and asset registers, incident workflows, continuity plans, testing plans, supplier records and supporting evidence. Your management body retains its governance responsibilities and approves the organisation's risk decisions.
We can assess whether an entity appears eligible for the simplified framework and help map relevant controls and evidence. Eligibility depends on the exact entity, activities and applicable law, so it should be confirmed with your legal and compliance advisers or competent authority.
DORA includes digital operational resilience testing requirements, but the appropriate tests depend on the entity, its risk and applicable rules. We can plan authorised vulnerability assessments, penetration tests, recovery exercises and related validation as part of a proportionate programme.
A production assessment is considered only with written authorisation, agreed systems and test windows, named contacts, safety limits and an escalation plan. We document scope and rules of engagement before any testing begins.
No. We provide implementation, assessment and security-testing support, and help organise evidence. Compliance decisions remain with your organisation and its management body; regulatory interpretation and supervisory decisions remain with the competent authorities.
Tell us what you need — we reply within one business day.
