Banking & Finance

Banks and insurers fall under DORA, the EU Digital Operational Resilience Act, which has applied since 17 January 2025. NIS2 and the GDPR also play a role. DORA requires ICT risk management, incident reporting, resilience testing and management of ICT third-party risk, including a register of information covering all ICT contracts with third parties. Responsibility sits with the management body of the institution.

For DORA a bank mainly needs DORA implementation consultants and TPRM or vendor risk specialists who can handle the register of information, ICT contracts and exit plans. Privacy officers and DPOs with financial experience and IAM and PAM specialists for banking platforms are also in high demand. A good TPRM specialist writes up a residual risk so that a board member can say yes or no to it, because the board is ultimately responsible under DORA.

MVPeople Group responds to every request within 4 hours and delivers introduction CVs for interim roles within 24 hours, often with a first profile within 4 hours. Candidates come from a network of more than 7,000 pre-screened cybersecurity professionals. MVPeople is NEN-4400-1 certified, WAADI registered, holds the SNA quality mark and works DBA-proof, which fits the procurement requirements of financial institutions.

For the catch-up on contracts and the register of information, an experienced interim specialist is usually the best choice, because you do not want that work done by someone doing it for the first time. Have someone from your own team work alongside them. The register goes to the supervisor every year, so afterwards a permanent or seconded employee is needed to keep it up to date.