The paid diagnostic

The DORA Vendor
Readiness Audit

Ten business days. Fixed fee. It ends with the artefact set your customers' compliance officers are going to ask for anyway.

Start the applicationNinety seconds. Reviewed personally, and you get a straight answer on fit.

Three lines of inquiry

What the audit examines

01 — Exposure

What have you already agreed to?

  • Financial-entity customer map, and which functions each service supports
  • Article 30 clauses already signed, and the obligations they created
  • Where your commercial terms and your DORA obligations conflict
  • Whether your own licence status puts you in direct scope
  • Concentration: how much revenue sits behind one supervisory relationship

02 — Chain

Can your rights be exercised downward?

  • Subcontractor inventory structured by service, not by supplier
  • Whether your subcontractor contracts mirror the rights your customers hold
  • Data location transparency through the chain, including support and backup
  • Notification and prior-authorisation process for chain changes
  • Material subcontractors below tier one, identified

03 — Evidence

Could you answer tomorrow?

  • Register of Information fields, in the format customers actually submit
  • Exit and data-return plan, tested rather than drafted
  • Incident notification timelines to customers, not just internal ones
  • Right-to-audit and resilience-testing position, agreed in advance
  • The authorisation log a customer's supervisor would ask to see

Core outputs

What the audit produces

  • DORA Vendor Readiness Score with per-customer breakdown
  • The five gaps most likely to stall a deal, ranked
  • Article 30 clause gap analysis against your current template
  • A Register of Information data pack your customers can ingest

Executive decision package

What you do with it

  • A 30 / 60 / 90-day correction plan with named owners
  • Board-ready findings memo
  • A 60–90 minute executive readout
  • A direct recommendation on the path forward
Vendor review is where enterprise financial deals die. The audit is priced against deal velocity, not against compliance.

Price

€9,500 – €16,000, fixed

One legal entity. Quoted before you commit, invoiced on completion of the readout. The range reflects the number of financial-entity relationships and the depth of your subcontracting chain.

Start the application

What is not included

Published, so you can rule us out

  • Not legal advice on contract negotiation
  • Not a penetration test or threat-led penetration testing
  • Not supervisory pre-approval — nobody can offer that
  • Not remediation. The audit tells you what is wrong and in what order to fix it.

If a deal is waiting

Vendor Pack Sprint — €4,500 fixed, five business days

Evidence only. Produces the Register of Information data pack, the subcontractor inventory structured by service, a documented exit plan, and a standing position on audit rights and resilience testing — so the customer review in front of you does not start from a blank page. The full audit follows once the deal is unblocked.

Apply for the sprint