More DORA, MiCA & NIS2 questions, answered

DORA is proportional, smaller firms have lighter requirements. We scope everything to your size. Most of the heavy lifting (policy writing, risk assessment, supplier mapping) is done by us. Your team reviews and approves, typically 2-4 hours per week.

We build ownership inside the organisation from day one: each artefact has a named internal owner, decision owner and review cadence. The 2-4 hours per week usually means short evidence reviews, owner interviews and approvals, not a second full-time project. If a team member is unresponsive, we surface the dependency in the remediation tracker so management can decide whether to escalate, accept the risk or change ownership.

NIS2 management-body accountability is implemented through national law, and details vary by jurisdiction (penalties, scope, reporting routes are jurisdiction-specific). Where you operate, the core obligation (that board members hold accountability for cybersecurity governance) typically applies under the local transposition. The practical fix is named ownership of ICT risk and documented oversight, both of which we deliver.

Yes. Board and management-body reporting is included in the retainer. Delivery options: written report (board-approved template), slide deck, or a 30-minute working session. Most management-body members want three things: a named owner, a current status, and a clear next action. That is what the reporting delivers.

Yes, 30 days’ notice after month 3 on the retainer. No long lock-ins.

2-4 hours per week for reviews and approvals. We do the heavy lifting; your team owns the decisions.

Primary: EU fintech jurisdictions. Engagements have been performed under EU financial-sector supervision. Other EU Member States on request.

That’s exactly the problem we solve most often. We restructure evidence packs, establish ownership, and build control traceability, so you stop answering the same questions repeatedly under audit.

CyAdviso is a registered company (SIA CyAdviso, Latvia), not a freelancer. For retainer clients, incident response access is defined in the service agreement with stated response times. On-call protocols for out-of-hours material incidents are part of the retainer scope. All client environments use shared, structured documentation. There is no tribal knowledge dependency on a single person’s memory.