Common worries (the fears)
Can a virtual CISO really satisfy our regulator under DORA?
DORA does not require the job title “CISO” — it requires clear ownership of ICT risk, documented governance, management-body oversight, and evidence that controls operate. We deliver exactly that, and we’ve done it for clients regulated by Bank of Lithuania, Bank of Latvia, the Central Bank of Cyprus and the UK FCA.
Our compliance officer already covers it. Isn’t that enough?
It’s the most common false-confidence state in 30–200 fintechs. Compliance officers are trained in legal / AML — cybersecurity is not their core domain. Under DORA, supervisors expect clear ICT-risk ownership distinct from the legal / AML compliance function, with documented governance and operating evidence. When the RFI lists ICT artefacts, those need an owner who can produce them. The fix isn’t a new headcount — it’s named ICT-risk ownership.
We’re a small team. Can we actually implement all of DORA?
DORA is proportional — smaller firms have lighter requirements. We scope everything to your size. Most of the heavy lifting (policy writing, risk assessment, supplier mapping) is done by us. Your team reviews and approves — typically 2–4 hours per week.
What if our internal team does not cooperate?
We build ownership inside the organisation from day one: each artefact has a named internal owner, decision owner and review cadence. The 2–4 hours per week usually means short evidence reviews, owner interviews and approvals, not a second full-time project. If a team member is unresponsive, we surface the dependency in the remediation tracker so management can decide whether to escalate, accept the risk or change ownership.
What if the audit still finds gaps after the engagement?
No serious CISO should promise that no reviewer will ever find another issue. The 90-day programme creates the defensible floor: named ICT-risk ownership, board-approved framework, current evidence index, incident workflow, supplier view and remediation tracker. If a review finds additional items, you can show what was known, who owned it, what was being remediated and how management was overseeing the risk.
We already have ISO 27001 / SOC 2. Is DORA overkill?
No — but those certifications reduce the lift. Existing ISO 27001, SOC 2, or prior audits typically reduce the DORA programme by 30–60%. We start with what you have and identify only the DORA-specific deltas.
Does NIS2 management-body accountability really apply to me as a CEO?
NIS2 management-body accountability is implemented through national law, and details vary by jurisdiction (penalties, scope, reporting routes are jurisdiction-specific). The UK has a separate cyber-security regime, not NIS2 transposition. Where you operate, the core obligation — that board members hold accountability for cybersecurity governance — typically applies under the local transposition. The practical fix is named ownership of ICT risk and documented oversight, both of which we deliver.
Can you present to our board or management body directly?
Yes. Board and management-body reporting is included in the retainer. Delivery options: written report (board-approved template), slide deck, or a 30-minute working session. Most management-body members want three things: a named owner, a current status, and a clear next action. That is what the reporting delivers.
How it actually works (the constraints)
What’s the minimum engagement?
3 months on the retainer model. The 90-day fixed-scope programme is exactly that. Single-engagement scopes start at 4–8 weeks.
Is there an exit clause?
Yes — 30 days’ notice after month 3 on the retainer. No long lock-ins.
How much of our team’s time does this take?
2–4 hours per week for reviews and approvals. We do the heavy lifting; your team owns the decisions.
Which jurisdictions do you cover?
Primary: EU + UK fintech jurisdictions — engagements have been performed under supervision of Lietuvos Bankas, Latvijas Banka, Central Bank of Cyprus and the UK FCA. Other EU Member States on request.
How is a vCISO engagement different from a Big 4 audit?
Big 4 tells you what’s wrong and hands you a report. We fix it. We build the framework, write the policies, train your team, and stay on retainer to keep it running. You get a CISO, not a PDF.
What if our evidence is scattered and we keep rebuilding it before every review?
That’s exactly the problem we solve most often. We restructure evidence packs, establish ownership, and build control traceability — so you stop answering the same questions repeatedly under audit.
What happens to our ICT risk programme when the engagement ends?
Nothing disappears. All policies, procedures, risk registers, and evidence packs are stored in your environment from day one — not ours. At the close of any engagement you receive a structured handover: documentation index, ownership map, and a continuity brief for whoever takes over the ICT risk function next. You own the work permanently.
You’re one person. What if you’re unavailable when we have an incident?
CyAdviso is a registered company (SIA CyAdviso, Latvia), not a freelancer. For retainer clients, incident response access is defined in the service agreement with stated response times. On-call protocols for out-of-hours material incidents are part of the retainer scope. All client environments use shared, structured documentation — there is no tribal knowledge dependency on a single person’s memory.