The problem. Since 17 January 2025, the EU DORA regulation requires banks, insurers, asset managers and other financial entities to manage the risks of their ICT providers. The data centers and hosting providers that run their systems are part of this. They must be listed, their resilience assessed, audit rights written into contracts and an exit strategy prepared. Compliance teams know what the text requires; they rarely have someone who can assess a data center's infrastructure on site.
Our answer. We carry out the physical and operational part of the assessment: site visit, power and cooling, redundancy, security, operations, continuity plans. The result feeds your DORA file, alongside your compliance team and legal advisers.
Our colocation contract includes an audit right and we do not know what to look at.
We must document an exit strategy for a data center that supports critical functions.
Our internal auditor asks for evidence on our provider's power continuity.
WHAT WE ASSESS
| Area | What we check on site |
|---|---|
| Power | Grid supplies, UPS, generators and fuel autonomy, tests performed, single points of failure |
| Cooling | Real redundancy, margins, behaviour in a heatwave or a failure |
| Physical security | Access, fire, natural hazards at the site, monitoring |
| Operations | Procedures, maintenance, incident and change management, on-call |
| Continuity | Business continuity and recovery plans, exercises performed, dependencies on other providers |
| Exit | Feasibility of a move to another site: lead times, constraints, available capacity |
Each finding is ranked by risk level and linked to the requirements you must document. When documents are not enough, we go and look: the truth is on the ground.
WHAT YOU GET
An assessment grid suited to your providers, a report per site with the gaps and the actions to request from the provider, and input for your exit strategy. We can also build the grid with you and apply it to several providers. Fixed fee, non-disclosure agreement, best-efforts obligation.
We do not give a legal opinion on your DORA compliance: that is the role of your compliance function and advisers. We bring what they often lack, the technical assessment of the infrastructure.
WHO IS INVOLVED
Frédéric Arnaud, former auditor at PricewaterhouseCoopers, coordinates the assignment and the assessment grid. Alain Constantinidis, DORA governance and compliance lead in an international group and former operations manager of Tier III and Tier IV rooms, leads the on-site assessment. Anis Mokded for operations and commissioning, Francis Gillard for cooling, energy and risk analysis. See also operations audit and our compliance pages.
FREQUENTLY ASKED QUESTIONS
Does DORA apply to data centers themselves?
DORA applies to financial entities, which must manage the risks of their ICT providers, including data centers and hosting providers. Providers designated as critical by the European authorities are also subject to direct oversight.
Do you replace our compliance team?
No. We carry out the technical and operational assessment of the sites. Legal analysis and decisions remain with your compliance function and advisers.
Can you assess several providers?
Yes. We can build a common grid and apply it to each one, to compare risks and prioritise actions.