Regulatory expertise you can build on.
We help organizations in regulated industries turn complex requirements (DORA, NIS2, ISO 27001/22301) into structured, defensible governance frameworks.
Regulations we cover:
- DORA
- NIS2
- ISO 27001 / ISO 22301
- EU AI Act
- MiCA
Our approach combines direct regulatory experience with hands-on implementation, so compliance isn’t just documentation: it’s built into how your organization actually operates.
WHAT WE DO
How we support regulated organisations
DORA Governance
Framework design and ICT risk alignment across legal entities.
Regulatory Gap Assessments
End-to-end reviews with structured remediation tracking.
ISO 27001 / ISO 22301
Implementation and governance maturity uplift.
Business Impact Analysis
BIA and resilience planning aligned with RTO/RPO requirements.
Executive Reporting
Audit readiness and supervisory alignment.
Third-Party Risk
Oversight of third-party and outsourcing risk.
NIS2 Compliance
Readiness and cybersecurity risk management alignment.
EU AI Act
Governance, risk classification, and compliance readiness for AI systems.
MiCA Alignment
Regulatory alignment under Markets in Crypto-Assets for crypto-asset service providers.
Our experience combines the perspective of regulated institutions and the supervisor.
From supervisory-level DORA implementation to end-to-end gap assessments, our engagements span the full spectrum of regulatory compliance in financial services.
CASE STUDIES
Selected engagements
DORA Governance & ICT Risk Alignment
A leading global reinsurance group and international insurer (name withheld under NDA)
Operating across multiple legal entities globally, this client needed to align its ICT governance and risk practices with the EU Digital Operational Resilience Act (DORA), translating one regulatory framework into consistent, entity-level implementation.
Our CTO led the governance and ICT risk alignment workstreams across multiple legal entities, driving structured remediation of gaps in ICT governance, operational resilience, third-party risk, and incident management, while establishing governance, reporting, and escalation mechanisms for executive oversight.
Outcome: Improved control transparency, clearer accountability, and structured risk tracking, raising the group’s operational resilience maturity and supporting audit and supervisory readiness.
Supervisory-Level DORA Implementation
Polish Financial Supervision Authority (UKNF)
As DORA moved from legislation to supervisory practice, national regulators needed to build the frameworks and methodologies to oversee ICT risk and operational resilience across supervised financial institutions.
Our CTO contributed to the supervisory-level implementation of DORA, supporting the development of ICT risk and operational resilience oversight frameworks, regulatory procedures, and supervisory methodologies, including alignment with Threat-Led Penetration Testing (TLPT) expectations.
Outcome: Direct contribution to the regulatory infrastructure used to supervise ICT risk and resilience across the financial sector, giving our team first-hand insight into supervisory expectations that we bring into every client engagement.
End-to-End DORA Gap Assessment & ISO Implementation
Regulated financial sector institutions
Financial institutions facing DORA and ISO compliance deadlines often have fragmented visibility into where their governance and resilience practices fall short, with no structured path from gap to fix.
Our CTO conducted end-to-end DORA gap assessments with structured remediation tracking and executive reporting, designed DORA-aligned governance frameworks (ICT risk registers, incident classification, outsourcing governance), and implemented ISO 27001 and ISO 22301 to strengthen resilience.
Outcome: Institutions moved from fragmented compliance gaps to audit-ready, regulator-defensible governance frameworks with tracked remediation and real recovery capabilities.
LET’S WORK TOGETHER
Let’s talk about compliance in your organisation
We help regulated organizations turn complex requirements into structured, audit-ready governance frameworks.
Contact us to:
- run a DORA/NIS2 gap assessment
- design a governance framework tailored to your organisation
- implement ISO 27001 / ISO 22301
- prepare for audit and supervisory review
