DORA, and the regulator wants to see it evidenced.

The moment

With DORA the moment is often a letter or a portal. The annual request for the register of ICT providers, a questionnaire from DNB or the AFM about ICT risk management, an incident report that has to go out within the deadline, or an audit that finds the policy exists but the evidence doesn't. The AFM reported that in the first year 40 percent of submitted registers were approved by the EBA and in 2026 94 percent; missing fields mean resubmitting the entire register. That kind of work doesn't call for another advisory report, but for someone who does it and can show it again next year.

What DORA asks of you

The regulation has applied since 17 January 2025 and rests on five pillars: ICT risk management with a framework approved by the board, reporting major ICT incidents to the regulator, testing digital resilience (for larger institutions also threat-led penetration testing), managing ICT third-party risk with a register of all contracts, and arrangements for sharing threat intelligence. DNB mainly supervises ICT risk management, the AFM conduct; many institutions deal with both. What exactly applies to your licence is for the regulator to determine, not us; we come into the picture once it's clear what needs to happen and there's nobody to lead it.

What needs to happen now

1. The register of ICT providers. Every contract, every service, every subcontractor, in the fixed format and again every year. Work for a third-party risk specialist or GRC officer, with procurement and legal alongside.
2. The ICT risk management framework. Policy, roles, risk analysis and board approval, with evidence that it's running. A DORA specialist or interim CISO.
3. Incident classification and reporting. What counts as a major incident, who decides, and how the report goes out on time. A security officer or IT risk manager, together with the incident team.
4. Testing. From vulnerability scans to, for those in scope, TLPT. Someone who sets up the programme and feeds the results back into risk management.
5. Supplier contracts. The mandatory clauses in every ICT contract, and the exit strategy for critical services. GRC and legal, with someone who keeps watch.

Who leads this

In practice, financial institutions look for a DORA specialist or GRC officer who leads the request and the register, an IT risk manager for the framework and the evidence, an interim CISO if the board needs to come along, or a third-party risk specialist for the suppliers. Which of those roles it is for you depends on what's already in place; that's where the intake starts. If you need someone permanently, that's simply permanent recruitment; temporarily, it's interim. We've been doing both for years.

Interim: within two days, and what it costs

Fast doesn't mean sloppy. We start with a proper intake: which pillar is the bottleneck, what the regulator asks exactly, who this person needs to bring along. Then we search a network of interim professionals we have usually known for years, which is how, for an interim assignment, you'll have your first candidate interviewed within two days. If you need someone permanently, it works differently and takes longer. The best permanent candidates are rarely actively looking: they're settled somewhere and only move for the right arguments, from someone who knows them and what drives them. That is exactly our work, and it produces the best match, but not within two days. Interim professionals are entrepreneurs: more commercial, more flexible in both directions, and therefore faster to propose from the network we actively maintain. If we don't have someone who truly fits, we'll say so. You always see the professional's rate and our margin separately, and that margin is never more than €15 per hour on a full-time assignment. You can contract the freelancer directly or through your own broker or procurement desk, in which case we invoice only our margin, or entirely through Gruzzy with a single invoice. Who is available right now, and in which rate band, is listed anonymously with the available interim professionals.

Freelance, and the Dutch DBA Act

Building a register, putting a framework in place or setting up a testing programme is an assignment with a clear beginning and end: there's a result, the professional decides how the work gets done, and there's no employer-style line of authority. That is what the Dutch tax authority wants to see now that enforcement on false self-employment has resumed since 2025, so freelance fits well here, with a model agreement. If the work is in fact a job, say the IT risk manager who stays on after the request, we'll say so. Usually that's a permanent role through recruitment; if you really want someone temporarily on payroll, secondment is possible, although it isn't our core business. We're happy to advise on this before you sign.