Your EU bank client wants DORA evidence. A policy PDF won't close the questionnaire.
Since January 17, 2025, EU banks, insurers, investment firms and payment institutions have had to apply the Digital Operational Resilience Act (Regulation (EU) 2022/2554) to every ICT vendor they use. Articles 28 to 30 push that work down to you, through contract clauses and due-diligence questionnaires. Reprisa runs the tests on your infrastructure and gives you a dated evidence file to attach to your answers.
A recovery plan on paper no longer passes
Questionnaires from EU financial clients increasingly ask for the date of your last test, its result and the gaps it found.
What most vendors have
- A disaster recovery document written two years ago
- Automated backups that have never been restored in full
- A data return clause with no tested export procedure
- A subcontractor list that lives in the CTO's head
What the Reprisa pack gives you
- A full restore test, timed, with recovery time and data loss measured
- A full data export of one client, checked for completeness
- A register of your subcontractors and where they process data
- A dated evidence file you can attach to every questionnaire
Why a US or UK vendor gets this questionnaire
DORA applies to EU financial entities, not to you. But Article 28 says they remain fully responsible for compliance when they outsource, and that responsibility travels down the contract.
Article 28
Your client must assess you before signing, keep a register of information on every ICT contract, and have documented, tested exit strategies for services that support critical or important functions.
Article 29
Your client must weigh concentration risk, including when you rely on subcontractors established in a third country.
Article 30
Every ICT contract must carry minimum clauses: service description, data locations, data return, incident assistance, audit and termination rights. More apply when you support a critical or important function.
Self-check: are you ready for your client's DORA questionnaire?
Twelve questions based on the clauses Article 30 requires in contracts with ICT vendors. Nothing is sent or stored.
The evidence pack, at a fixed price
Read-only access and an isolated test environment: nothing changes in production without your written approval. Works on AWS, Google Cloud, Azure and Kubernetes. Prices in USD, excluding taxes.
DORA evidence pack
$3,200
- Full restore test in an isolated environment, timed end to end, RTO and RPO measured
- Full data export of one client, checked for completeness
- Subcontractor register: name, role, country, data concerned
- Dated evidence file, ready to attach
Evidence pack + exit exercise + questionnaire answers
$5,400
- Everything in the evidence pack
- Exit exercise: the hand-over to a new provider walked through step by step, with durations taken from the tests
- Written exit plan with a transition period
- Written answers to your client's DORA questionnaire
How it runs
- Week 1: inventory. Read-only access. Architecture, backups, subcontractors, your standard contract, and your client's questionnaire if you have it.
- Week 2: tests. Full restore into an isolated environment, export of one client's data set, durations measured. Gaps are fixed along the way when possible.
- Week 3: evidence file. Dated report, register, procedures, and the questionnaire answers if you took the larger pack.
What this is, and what it isn't
Amine, a freelance DevOps engineer based in France, runs the tests himself on AWS, Google Cloud, Azure or Kubernetes, and writes up what happened, including what didn't work.
Reprisa is not a law firm or an auditor. The pack is not a certification. It gives your answers dates, durations and documents your client can check.
Frequently asked questions
Does DORA apply to a US SaaS company?
Not directly, unless you are designated as a critical ICT third-party provider. DORA (Regulation (EU) 2022/2554) applies to EU financial entities. Articles 28 to 30 make them manage the risk of their ICT vendors and put specific clauses in every contract, so the requirements reach you through the contract and the due-diligence questionnaire.
What does a DORA vendor questionnaire usually ask?
Where your data and processing are located, including subcontractors; your subcontractor list; when you last tested your continuity plan and with what result; your measured recovery time and data loss; whether you can return all of a client's data at the end of the contract; your incident procedure; and audit rights.
What is a DORA exit strategy?
For ICT services that support critical or important functions, Article 28(8) requires the financial entity to have documented exit strategies, and Article 30(3) requires a mandatory, adequate transition period in the contract. In practice your client will ask whether you can hand over its data in a usable format and support a migration.
Are we a critical ICT third-party provider?
Almost certainly not if you are a typical SaaS vendor. The European Supervisory Authorities published their first list of 19 designated providers on November 18, 2025, mostly large cloud, data center, network and financial-technology providers. Your own cloud provider may be on it.
How long does the evidence pack take?
Three weeks: one week of inventory, one week of tests (restore, data export), one week to write the evidence file and, if you take the larger pack, the questionnaire answers.
Is the evidence pack a certification?
No. It is a set of dated tests and documents you can attach to your answers. Reprisa is not a law firm or an auditor, and the pack is not a certification or a legal opinion.
Talk about your questionnaire
Written reply within one business day, with a fixed price. No sales sequence.
Sent. You will get a written reply with a fixed price within one business day.