01
Review materials
We gather policies, instructions, contracts and activity records. We establish scope, missing information and contacts who can explain working practices.
Documents used in practice
DORA policies and procedures
We prepare and organise DORA documentation around actual services, systems and working practices. We agree roles, decisions, forms and update rules. With the team, we check whether a procedure enables a task to be performed, not simply another document to be signed.
Trusted by
Companies and institutions that need stable IT.
The team should know what to do and whom to notify
We start with current practice: who receives reports, makes decisions and contacts providers. We review existing documents, including those prepared for ISO 27001. Useful elements are retained and missing scope is added instead of creating a second, conflicting set of rules.
Connecting documentation with the other work
Procedures should reflect the capabilities of systems and people. Gaps in settings, knowledge or organisation become separate tasks.
DORA audit
Reviewing documents and practice before planning improvements.DORA implementation
Coordinating organisational and technical changes beyond documents.Backup and recovery
Practical recovery tests as a basis for usable instructions.Security training
Preparing employees for agreed rules and incident response.ISO 27001 · TÜV NORD Polska
TÜV NORD Polska has certified Virtline’s information security management system to PN-EN ISO/IEC 27001:2023-08. The published certificate states its scope and validity.
View Virtline’s certificateHow the DORA procedure project runs
Documents are developed with process owners. Approval of wording and checking practical use are separate steps.
02
Draft and agree
We prepare drafts with specific tasks and responsibilities. Process owners agree decisions, contacts, forms and links to other documents.
03
Workshop and revisions
We work through selected scenarios with the team, such as reporting an incident or a provider problem. Unclear steps are corrected; missing safeguards and access rights are recorded separately.
04
Approval and maintenance
Agreed versions are submitted to the appropriate people in your business for approval. We define internal publication, team familiarisation and responsibility for future updates.
Practical scope
What the business and team receive
The documentation scope follows a review of existing material. We do not promise a universal package that fits every organisation without changes.
Agreed rules for IT risk, incidents, continuity and providers. Documents identify those carrying out and approving work, including how exceptions are handled. Within the agreed scope, we document the business impact analysis (BIA), recovery time and recovery point objectives (RTO/RPO), the testing plan and risk reporting to management. We record requirements for supplier contracts and a service exit plan; the company’s responsible representatives approve the legal wording.
Materials for recording risks, incidents, tests and provider services. We distinguish internal records from the formal register of information required by DORA.
Selected scenarios worked through with the people performing tasks. Unclear instructions, missing contacts and decisions are recorded, with documents revised within scope.
Document owners, versions, reviews and events triggering changes. We hand over approved material and identify matters still awaiting decisions.
A signed procedure is not a substitute for tested practice
A document should describe actions that can actually be performed. Missing backups, access, provider contacts or decision-makers are not fixed by wording alone. We separate documentation work from implementing safeguards and from independently assessing their effectiveness.
Questions about DORA policies and procedures
Can we reuse our ISO 27001 documentation?
+
Yes, after reviewing its scope and currency. We identify reusable parts and gaps against agreed DORA requirements. An ISO 27001 certificate alone does not demonstrate that all DORA obligations have been met.
Do you prepare the register of information on providers?
+
We can help gather and organise the necessary data. Scope, applicable templates and submission arrangements must be confirmed for the entity. An internal provider list with risk ratings is not automatically a reporting-ready register.
Will the incident procedure include reporting deadlines?
+
Within scope, we define classification, owners, decision paths and deadlines based on applicable requirements. The specific reporting duties must be confirmed for the entity. We do not assign the same deadline to every kind of event.
Are the documents alone enough to complete preparations?
+
No. Technical changes, exercises, training, provider arrangements and further assessment may be needed. We hand over open matters rather than treating them as resolved simply because a procedure exists.
Organise your DORA documentation
Tell us what material you already have and which procedures cause problems. Mention your business activity, people involved and deadline. Do not attach confidential documents to the initial enquiry.
Discuss DORA procedures