IT Consulting in Dublin

Financial Services / Regulatory Compliance

A CBI-regulated insurance company headquartered in Dublin (EUR 2.1 billion gross written premium, 1,800 employees, operations across Ireland, UK, and continental Europe) needed to achieve DORA compliance by the January 2025 deadline. The company operated a complex IT estate: 186 enterprise applications, hybrid infrastructure (on-premise data centre and AWS), 42 ICT third-party service providers, and a 120-person IT department. A gap assessment against DORA requirements revealed significant deficiencies: no formal ICT risk management framework (IT risk was managed informally through the CTO's knowledge rather than documented processes), incident management existed but did not meet DORA reporting requirements (no classification taxonomy aligned with DORA, no reporting workflow to the CBI), no digital operational resilience testing programme existed beyond basic vulnerability scanning, and ICT third-party risk management was limited to annual vendor questionnaires with no risk classification, no contractual DORA provisions, and no ongoing monitoring of critical providers. The CBI had communicated clear expectations that regulated institutions would be DORA-compliant by the effective date, and the company's Chief Risk Officer was accountable for delivering compliance within a 10-month timeframe. The complexity was compounded by the company's cross-border operations: the UK subsidiary was subject to PRA/FCA operational resilience requirements that overlapped with but did not mirror DORA, requiring an approach that satisfied both regulatory frameworks.

We designed and implemented the DORA compliance programme over 40 weeks (10 months). Phase 1 (weeks 1-8): ICT risk management framework. We built the comprehensive framework that DORA Article 6 requires: ICT asset inventory catalogued all 186 applications and supporting infrastructure with business criticality classification (critical, important, standard). ICT risk assessment methodology applied threat and vulnerability analysis to each critical and important ICT asset, producing risk scores and required controls. Risk appetite statement defined the institution's tolerance for ICT risk, approved by the board. ICT risk policies and procedures documented the ongoing risk management processes: risk identification, assessment, treatment, monitoring, and reporting. The framework integrated with the company's existing enterprise risk management approach, ensuring ICT risk reporting flows into board-level risk governance. Phase 2 (weeks 6-16): ICT incident management. We redesigned incident management to meet DORA requirements: incident classification taxonomy aligned with DORA's major incident criteria (number of clients affected, economic impact, duration, geographic spread, data losses, criticality of services affected). Incident detection using SIEM tooling (Splunk) with correlation rules that identify ICT incidents from security events, infrastructure alerts, and application errors. Incident response procedures with defined roles, escalation paths, communication templates, and decision trees for classification against DORA major incident criteria. CBI reporting workflow for major ICT-related incidents: initial notification within 4 hours, intermediate report within 72 hours, and final report within one month. Incident response testing through tabletop exercises simulating major ICT incidents (ransomware, cloud provider outage, data breach) to validate the incident management process. Phase 3 (weeks 12-28): digital operational resilience testing programme. We designed a risk-based testing programme proportionate to the institution's size and risk profile: vulnerability assessments and penetration testing of critical applications and infrastructure on an annual cycle, network security testing including internal and external penetration testing, application security testing (OWASP methodology) for customer-facing applications, scenario-based testing simulating business-critical ICT disruptions, and source code review for internally developed critical applications. For the institution's most critical systems (core insurance platform, claims management, policyholder portal), we conducted threat-led penetration testing following TIBER-EU methodology: threat intelligence-led red team exercises that simulate realistic adversary behaviour against the institution's defences. Testing results fed back into the ICT risk assessment, creating a continuous improvement cycle. Phase 4 (weeks 16-36): ICT third-party risk management. We assessed all 42 ICT service providers: classified by criticality (8 critical, 14 important, 20 standard) based on the services provided and their impact on the institution's critical functions. For critical providers: comprehensive risk assessment, contractual review and remediation (ensuring DORA-required provisions for audit rights, incident notification, data location, exit strategy), ongoing monitoring through service level tracking and periodic reassessment, and documented exit strategies. We established a centralised ICT third-party risk register with ongoing monitoring and periodic board reporting. Phase 5 (weeks 30-40): governance, documentation, and board reporting. Board-level ICT governance: established an ICT Risk Committee with defined terms of reference, regular reporting cycle, and clear escalation paths. DORA documentation package: all required policies, procedures, frameworks, and registers documented and approved through governance. CBI readiness: prepared for CBI supervisory engagement with comprehensive compliance evidence package.

The institution achieved DORA compliance ahead of the January 2025 deadline and passed the first CBI supervisory engagement with zero material findings. ICT risk management: all 186 applications and supporting infrastructure assessed and documented with risk ratings. 23 high-risk items identified and remediated during the programme (8 through patching, 6 through configuration hardening, 5 through enhanced monitoring, 4 through application retirement). Incident management: incident detection time improved from 4.2 hours average to 18 minutes through SIEM correlation rules. Three incident response tabletop exercises completed, each resulting in process improvements. One actual major incident during the programme period was managed and reported to the CBI within the required timeframe -- validating the new processes under real conditions. Resilience testing: penetration testing identified 34 vulnerabilities across critical applications (12 high, 14 medium, 8 low), all remediated within agreed timeframes. Scenario-based testing validated recovery capabilities for the 6 most critical business scenarios. TIBER-EU exercise on the core insurance platform identified 3 previously unknown attack paths, all subsequently remediated. Third-party risk: 8 critical provider contracts renegotiated with DORA-required provisions. 3 providers replaced due to inability to meet contractual requirements. Third-party risk monitoring dashboard providing real-time visibility into provider performance and risk indicators. UK alignment: the framework was designed to satisfy both DORA and PRA/FCA operational resilience requirements, with a single control framework mapped to both regulatory expectations -- avoiding duplication of effort for the cross-border operation. Board governance: quarterly ICT risk reporting established with the board actively engaged in ICT risk oversight for the first time. Implementation cost: EUR 680,000 (consulting + tooling). The CRO estimated that the compliance programme also delivered EUR 400,000 in annual IT risk reduction value (avoided incidents, improved resilience, better vendor management) -- beyond the regulatory compliance value.