SVC.02.1
DORA readiness and operational resilience
Important business services mapped, impact tolerances set, the critical third party register built, and a testing programme that produces evidence.
SVC.02
The two questions you cannot answer on the day you need to.
Which supplier failing would stop you trading, and where exactly is your customers' personal data. Most organisations discover they cannot answer either one during an incident or a regulator's request, which is the worst possible time. This practice is about having both answers documented, tested and current.
Services
What we do
SVC.02.2
Third party and supply chain assurance
A supplier risk programme with tiering, due diligence that matches the tier, contract clauses, and ongoing monitoring that does not depend on one person's spreadsheet.
SVC.02.3
Business continuity and disaster recovery
Plans tied to real recovery objectives, and exercises that test them rather than confirm them.
SVC.02.4
UK GDPR and data protection programme
Records of processing, lawful bases, retention, DPIAs and international transfer assessments, built so they stay current.
SVC.02.5
Data Protection Officer as a service
The role filled by someone who has done it, for organisations that need it before they can justify the hire.
SVC.02.6
ISO/IEC 27701 privacy information management
The privacy extension to an existing ISO 27001 management system.
SVC.02.7
Data mapping and discovery
Where personal and regulated data actually lives, including the copies nobody meant to make.
Deliverables
What you get
- 01A register of suppliers and services you can hand to a regulator, with tiering rationale.
- 02Impact tolerances agreed by people with the authority to agree them.
- 03Records of processing that match reality, not the reality of two years ago.
- 04DPIAs that a supervisory authority would accept.
- 05Tested plans, with the test results as evidence.
Engagements
Engagement
DORA gap assessment
Shape
Fixed fee, 4 to 6 weeks
From
from £18,000
Engagement
DORA remediation and resilience programme
Shape
Fixed fee
From
from £35,000
Engagement
Third party and supply chain assurance programme
Shape
Fixed fee
From
from £8,000
Engagement
UK GDPR programme build
Shape
Fixed fee
From
from £12,000
Engagement
DPIA or transfer assessment, per assessment
Shape
Fixed fee
From
from £3,500
Engagement
DPO as a service
Shape
Monthly, 12 month term
From
from £1,500 per month
Engagement
ISO 27701 implementation
Shape
Fixed fee
From
from £15,000
Engagement
Business continuity plan and exercise
Shape
Fixed fee
From
from £6,000
Findings and recommendations are provided for review by your qualified legal, compliance or risk function. We do not replace it.
Fit
Who this is for
01
You are in DORA scope and the register of information is still a spreadsheet.
02
A customer's supplier assurance questionnaire has stalled a contract.
03
You need a DPO and cannot justify a full-time one.
04
You have had a near miss with a supplier and nobody owns the follow-up.
FAQ
Questions, answered.
Next step
Start with a conversation, not a proposal.
Thirty minutes. We will tell you what we would do, what it would take, and whether we are the right firm for it.