More due diligence
Customers want evidence of your security controls and how you keep services running.
DORA 
compliance.Sorted. Secure. Fast.
Prepare for DORA requirements from your EU financial services customers. We help ICT providers scope the work, implement security controls, and organize evidence for customer reviews.
Expert guidance- Real security controls
- Customer readiness
The problemDORA is here.
DORA is here.
Your customers are asking.
EU financial firms may bring DORA requirements into your contracts and due diligence. We help you understand what they need.
New contract terms
New terms may add security commitments your team needs to understand and support.
Closer security reviews
Be ready to show how your controls work, with current documentation and test results.
Guidance. Implementation.
Done.
Understand what applies, implement controls, and prepare evidence with one partner for DORA guidance and technical security.
Know what applies
We map DORA requirements to your services, identify controls already in place, and prioritize the gaps.
Test your resilience
Use built-in penetration testing, vulnerability scanning, and continuous monitoring to support your resilience testing work.
Prepare for customer reviews
We help prepare documentation and evidence for financial customers’ due diligence questionnaires, security reviews, and audits.
DORA expertise. Direct access.
Work with experts through scoping, implementation, and customer readiness.
Relevant DORA requirements
Your role as an ICT provider
Your customers’ evidence needs
Existing security work you can reuse
Security first. Compliance follows.ISO 27001? SOC 2?
ISO 27001? SOC 2?
Build on it.
Map your existing ISO 27001, SOC 2, or other security controls to relevant DORA requirements. Focus on gaps instead of repeating work.
Security first. Compliance follows.ISO 27001? SOC 2?
ISO 27001? SOC 2?
Build on it.
Map your existing ISO 27001, SOC 2, or other security controls to relevant DORA requirements. Focus on gaps instead of repeating work.
Real security.
Starts with a closer look.
We test the systems you actually run, not a questionnaire. Every check shows what’s working, what isn’t, and which frameworks each gap touches.
One gap.
More than one framework.
Every result maps to the frameworks it belongs to. One gap can hold back several at once.
Your agent fixes what it can.
It prepares the fix, you approve it, and we retest. One verified fix counts toward every framework that needs it.
An expert handles the rest.
Some gaps need human judgment. Your Oneleet expert works through the details with you and verifies the result.
One fix. Progress everywhere.
The same security work moves SOC 2, ISO 27001, GDPR, HIPAA, FedRAMP and ISO 42001 forward together. Explore the checks they share.
Security tools.
Compliance expertise.
Connect technical testing, framework knowledge, and focused delivery in your DORA program.
Built-in security tools
Run penetration testing, vulnerability scanning, and monitoring in the same platform as your compliance work.
Framework expertise
Build on work from ISO 27001, SOC 2, and NIS2 with guidance on how it relates to DORA.
Focused delivery
Define the scope, prioritize requirements, and work through implementation with expert support.
Start with your ICT services.
Tell us what you provide. We’ll scope your DORA work.
Your ICT services
What do you provide to EU financial firms?
Existing certifications
What security certifications do you hold?
Customer requirements
What are your customers asking you to meet?
DORA questions,
answered plainly.
What ICT service providers ask before getting started.
Is DORA actually being enforced?
DORA has applied since January 17, 2025. EU financial entities must manage ICT third-party risk. Their due diligence and contracts bring relevant requirements to ICT providers, including requests for evidence.
I’m not in the EU. Does this apply to me?
Relevant requirements can flow through contracts when you serve EU-regulated financial entities, wherever you are based. Your scope depends on your services and customer relationships.
How is DORA different from NIS2?
NIS2 covers cybersecurity across sectors. DORA focuses on operational resilience in financial services. Some requirements overlap; we help you coordinate the relevant work.
Can I use my SOC 2 or ISO 27001 work?
Yes. We map existing SOC 2 or ISO 27001 controls to relevant DORA requirements and focus on the gaps.
What do my customers actually need from me?
Evidence of ICT risk management, incident handling, resilience testing, and contractual commitments. We help prepare documentation for their due diligence requirements.
Is a penetration test enough for DORA readiness?
No. Resilience testing is one part. ICT risk management, incident handling, and third-party risk also matter. We help map relevant customer requirements to your controls and evidence.