From the regulator’s letter to
audit-ready in 90 days.

DORA does not require the job title “CISO” — it requires clear ownership of ICT risk, documented governance, management-body oversight, and evidence that controls operate. We deliver exactly that, and we’ve done it for clients regulated by Bank of Lithuania, Bank of Latvia, the Central Bank of Cyprus and the UK FCA.

It’s the most common false-confidence state in 30–200 fintechs. Compliance officers are trained in legal / AML — cybersecurity is not their core domain. Under DORA, supervisors expect clear ICT-risk ownership distinct from the legal / AML compliance function, with documented governance and operating evidence. When the RFI lists ICT artefacts, those need an owner who can produce them. The fix isn’t a new headcount — it’s named ICT-risk ownership.

DORA is proportional — smaller firms have lighter requirements. We scope everything to your size. Most of the heavy lifting (policy writing, risk assessment, supplier mapping) is done by us. Your team reviews and approves — typically 2–4 hours per week.

We build ownership inside the organisation from day one: each artefact has a named internal owner, decision owner and review cadence. The 2–4 hours per week usually means short evidence reviews, owner interviews and approvals, not a second full-time project. If a team member is unresponsive, we surface the dependency in the remediation tracker so management can decide whether to escalate, accept the risk or change ownership.

No serious CISO should promise that no reviewer will ever find another issue. The 90-day programme creates the defensible floor: named ICT-risk ownership, board-approved framework, current evidence index, incident workflow, supplier view and remediation tracker. If a review finds additional items, you can show what was known, who owned it, what was being remediated and how management was overseeing the risk.

No — but those certifications reduce the lift. Existing ISO 27001, SOC 2, or prior audits typically reduce the DORA programme by 30–60%. We start with what you have and identify only the DORA-specific deltas.

NIS2 management-body accountability is implemented through national law, and details vary by jurisdiction (penalties, scope, reporting routes are jurisdiction-specific). The UK has a separate cyber-security regime, not NIS2 transposition. Where you operate, the core obligation — that board members hold accountability for cybersecurity governance — typically applies under the local transposition. The practical fix is named ownership of ICT risk and documented oversight, both of which we deliver.

Yes. Board and management-body reporting is included in the retainer. Delivery options: written report (board-approved template), slide deck, or a 30-minute working session. Most management-body members want three things: a named owner, a current status, and a clear next action. That is what the reporting delivers.

3 months on the retainer model. The 90-day fixed-scope programme is exactly that. Single-engagement scopes start at 4–8 weeks.

Yes — 30 days’ notice after month 3 on the retainer. No long lock-ins.

2–4 hours per week for reviews and approvals. We do the heavy lifting; your team owns the decisions.

Primary: EU + UK fintech jurisdictions — engagements have been performed under supervision of Lietuvos Bankas, Latvijas Banka, Central Bank of Cyprus and the UK FCA. Other EU Member States on request.

Big 4 tells you what’s wrong and hands you a report. We fix it. We build the framework, write the policies, train your team, and stay on retainer to keep it running. You get a CISO, not a PDF.

That’s exactly the problem we solve most often. We restructure evidence packs, establish ownership, and build control traceability — so you stop answering the same questions repeatedly under audit.

Nothing disappears. All policies, procedures, risk registers, and evidence packs are stored in your environment from day one — not ours. At the close of any engagement you receive a structured handover: documentation index, ownership map, and a continuity brief for whoever takes over the ICT risk function next. You own the work permanently.

CyAdviso is a registered company (SIA CyAdviso, Latvia), not a freelancer. For retainer clients, incident response access is defined in the service agreement with stated response times. On-call protocols for out-of-hours material incidents are part of the retainer scope. All client environments use shared, structured documentation — there is no tribal knowledge dependency on a single person’s memory.