01
Baseline and plan
We review existing findings, services, systems and providers. We agree priorities, scope, responsibilities and how results will be verified.
From findings to action
DORA rollout
We help implement agreed changes needed to address DORA requirements. We combine organisational work with security settings, incident handling, testing and work with IT providers. Scope, costs, dates and responsibilities are agreed with your business before work begins. We tailor the scope for financial entities subject to DORA or ICT suppliers responding to their financial-sector customers’ requirements.
Trusted by
Companies and institutions that need stable IT.
Turn assessment findings into team tasks
We can start from an existing audit or establish a baseline together. We separate tasks for IT, service owners, compliance and contract owners. Each task has an agreed acceptance method, so buying a tool or signing a policy does not automatically resolve the underlying problem.
Work brought together in implementation
Different businesses need different changes. Tasks reflect assessment findings, the environment and team capacity; work outside the scope is agreed separately.
DORA audit
Assessing the starting point and areas needing improvement.Policies and procedures
Working rules, responsibilities and forms for everyday use.Backup and recovery
Backup configuration and tests of required data recovery.Vulnerability management
Finding, prioritising and verifying remediation of vulnerabilities.ISO 27001 · TÜV NORD Polska
TÜV NORD Polska has certified Virtline’s information security management system to PN-EN ISO/IEC 27001:2023-08. The published certificate states its scope and validity.
View Virtline’s certificateDORA implementation process
We work in stages that can be checked and accepted. Changes affecting systems are planned with their owners and users.
02
Preparation and changes
We prepare agreed procedures and settings with process owners. Contract terms and legal interpretations require appropriate approval within your business. The scope can include staff training and preparation of the incident reporting process: who collects information, who approves the report and who submits it to the appropriate recipient. We also prepare document templates tailored to the organisation, including operational resilience test plans.
03
Exercises and corrections
We test selected incident, recovery or provider scenarios. We record results, correct identified issues and repeat the necessary checks.
04
Acceptance and reviews
We hand over documentation, results and open matters. Further reviews and maintenance are agreed; project completion does not end your business obligations.
Practical scope
What we hand over after an agreed stage
Acceptance is based on tasks and tested activities, not just the number of documents produced. Unresolved matters remain visible.
Tasks, dependencies and decision-makers. We agree dates, resources and matters retained by your business, providers or legal advisers.
Configured IT elements and working rules within scope. We document approved changes, exceptions and matters requiring further decisions.
Records of agreed exercises or tests, such as incident handling and data recovery. A failed result creates a remediation task rather than a claim of completion.
Documentation, instructions and an agreed review schedule. We identify who updates information when systems, services, contracts or responsible people change.
A provider can help, but does not take over your responsibility
The financial entity remains responsible for its DORA requirements. Working with IT specialists, a lawyer or a cloud provider does not remove that duty. We record our tasks and responsibility boundaries in the scope; purchasing one package is not a guarantee of compliance. Gaps in incident handling, recovery or provider oversight can lead to service disruption, financial loss and reduced customer trust. We consider these consequences when prioritising changes.
Questions about DORA implementation
Do we need another audit before implementation?
+
Not always. An existing, current report can be used if its scope and findings are sufficient to plan changes. We first establish missing information and changes since the assessment rather than automatically commissioning another full audit.
Do you also implement technical safeguards?
+
We can perform agreed work on access, backups, monitoring and other IT areas. The scope depends on findings, existing tools and other providers’ responsibilities. Not every improvement requires replacing a system.
Will you handle provider contracts?
+
We help collect service, dependency and technical requirement information and identify matters needing clarification. Legal approval and negotiations are agreed with contract owners. Technical analysis is not presented as legal advice.
How long does implementation take, and what affects cost?
+
The starting point, changes required, system count and availability of decision-makers and providers. Following a review, we propose scoped and costed stages. We do not promise full compliance for every organisation within one fixed deadline.
Plan the DORA changes you need
Describe your current preparations and main problems. Tell us whether you have a report, recommendations and a deadline. We will agree scope and secure document sharing during the discussion.
Discuss DORA implementation