The same problems, in five different rooms.

DORA enforced, BaFin attentive, and an internal IT team built for operations, not for an ICT risk framework. The bank needed a compliance programme that would satisfy a supervisor and a security lead who could sit across from one.

Built the DORA programme end to end: ICT risk framework, asset register, third-party register, and an incident process rehearsed against the 72-hour clock. A Lockpoint vCISO took ownership of posture, board reporting, and the regulator interface, on retainer.

An AWS and Google Workspace estate that had grown deal by deal, FINMA expectations rising, and previous advisers pushing a platform migration the firm didn’t need. They wanted ISO 27001 without rebuilding their stack to suit someone’s resale margin.

Architecture cleanup first: mapped the estate, standardized configuration against CIS Benchmarks, consolidated duplicate tooling, then implemented ISO 27001 on the result. No migration, no new platform, no licenses sold.

Not regulated themselves, but every customer is. DORA third-party requirements started arriving as contract clauses and two-hundred-question DDQs, and a stalled questionnaire was blocking a renewal. Sales was negotiating security claims nobody could evidence.

DORA third-party readiness mapped to what banks actually ask, a SOC 2 programme to answer the questions permanently, and penetration testing through our vetted specialist network. We answered the live DDQs with them, line by line.

A growing group with IT spread across departments, vendors nobody owned, and NIS2 on the horizon. Hiring and running an internal IT and security team at this size would have cost more and delivered less than the problem deserved.

Full MSP plus MSSP under one contract: zero-touch device lifecycle through MDM, identity and access through SCIM, helpdesk, privileged access management, hardening, and managed detection and response. Vendor register consolidated, duplicate tools cancelled.

Series B underway, investor due diligence already asking security questions, and DORA plus ISO 27001 both unanswered. A traditional consulting timeline would have outlived the funding round.

Ran Clarity, Automation, and the compliance build in parallel where the sequence allowed it: asset and access mapping feeding the DORA register, SCIM and MDM closing the gaps the auditors would flag, ISO 27001 implementation scoped to what a payments firm of 55 actually runs.