// METHODOLOGY //
A transparent, deterministic methodology aligned with ISO 27001, NIS2, DORA, and DORA-ICT (for third-party ICT providers). Same answers → same rating, every time.
Score aggregated across 3 cybersecurity frameworks.
// OVERVIEW //
Finnovia assesses organizations against four cybersecurity frameworks: FR-Basic (aligned with ISO 27001), FR-NIS2, FR-DORA and FR-ICT (for third-party ICT providers serving DORA-regulated financial entities). Each assessment is based on a structured questionnaire organized by domains, where answers are converted into weighted scores to produce an FR Cyber Rating.
Our methodology is designed to be transparent, reproducible, and aligned with European regulatory requirements. Domain weights reflect each framework's regulatory priorities.
FR-Basic
Information Security Management
56 questions · 10 domains
FR-NIS2
Network and Information Security
37 questions · 7 domains
FR-DORA
Digital Operational Resilience
38 questions · 7 domains
FR-ICT
ICT third-party providers — DORA Art. 30
16 questions · 6 domains
FR-ICT
Assesses an ICT provider's readiness to meet the contractual and operational requirements that its DORA-regulated clients must impose on it under Article 30 of DORA: contractual clauses, data security, incident notification, continuity and exit, sub-outsourcing and independent assurance. 6 domains, 14 questions. The requirement flows from the client relationship: a provider outside the EU is assessed exactly like one inside it.
// Categories //
Not every organization is assessed against every framework. Finnovia automatically determines which frameworks apply based on factual attributes captured during onboarding — organizations are never asked to self-classify as a DORA, NIS2 or ICT entity.
Banks and financial market infrastructures that also meet NIS2's medium or large size thresholds.
Assessed on: FR-DORA · FR-NIS2 · FR-Basic
Other DORA-regulated financial entities — insurers, investment firms, asset managers, payment and e-money institutions, crypto-asset service providers and others — whatever their size, as well as banks and financial market infrastructures below NIS2's size thresholds.
Assessed on: FR-DORA · FR-Basic
Any organization supplying ICT products or services to a DORA-regulated financial entity — regardless of the provider's own location, size, or sector. A provider based outside the EU is assessed exactly the same way as one based inside it, because the requirement flows from the client relationship, not the provider's own regulatory status. Category 3 status is established through a single direct question during onboarding: does this organization supply any DORA-regulated financial entity. This is never inferred or assumed from sector, size, or location. An organization only enters Category 3 if it confirms this directly. A provider that itself falls under NIS2 belongs to Category 4 and is additionally assessed on FR-ICT.
Assessed on: FR-ICT · FR-Basic
Organizations in NIS2-covered sectors (energy, transport, health, digital infrastructure, and others) meeting NIS2's size thresholds, or covered regardless of size, such as DNS or trust service providers.
Assessed on: FR-NIS2 · FR-Basic — + FR-ICT if the organization also supplies ICT products or services to a DORA-regulated financial entity.
Organizations with no DORA or NIS2 relevance — including those outside the EU with no DORA-regulated clients.
Assessed on: FR-Basic (the universal baseline)
// HOW IT WORKS //
For each domain, the score is the average of provided answers, converted to a percentage. "Not Applicable" answers are excluded. A domain where all questions score level 3 (Managed) will have a 75% score.
The composite score is calculated as the weighted sum of each domain score. Each domain contributes proportionally to its weight, which reflects its importance within the framework.
The composite score is converted into an FR Cyber Rating using a fixed 8-level scale, from FR-Cyber F (score below 20%) to FR-Cyber A (score of 90% or above). Each rating level is determined by predefined thresholds encoded in the methodology and is never adjusted post-hoc.
// MATURITY SCALE //
Each question is assessed on a 5-level maturity scale, from 0 (no measures in place) to 4 (optimized process with continuous improvement).
| Level | Maturity | Score |
|---|---|---|
| 0 | None | 0% |
| 1 | Initial | 25% |
| 2 | Defined | 50% |
| 3 | Managed | 75% |
| 4 | Optimized | 100% |
| N/A | Not applicable | excluded |
// FR RATING SCALE //
The FR-Cyber Rating translates the overall score into a comparable grade based on FR Rating Scale. It provides an immediate reading of compliance maturity.
// FR-CYBER RISK BANDS //
The 8 FR Cyber Rating levels aggregate into three risk bands for high-level reporting and benchmarking — defined in Methodology Book §5.1.
≥ 70%
FR-Cyber A · FR-Cyber A- · FR-Cyber B+
Strong cybersecurity posture with measured, documented and consistently applied controls.
50 – 69%
FR-Cyber B · FR-Cyber B-
Satisfactory posture with identified improvement areas and known residual risks.
< 50%
FR-Cyber C · FR-Cyber D · FR-Cyber F
Significant gaps requiring immediate attention; controls are partial, ad hoc or absent.
// DOMAIN WEIGHTS //
Each framework assigns different weights to its domains, reflecting regulatory priorities. Higher-weighted domains have a greater impact on the final rating.
56 questions · 10 domains
37 questions · 7 domains
38 questions · 7 domains
16 questions · 6 domains
// VALIDITY //
Every rating carries a fixed validity window. Once expired, it stops counting as a current credential and is no longer listed on the public ratings page.
12 months
From submission date
Reflects answers submitted by the organisation. No analyst review at this stage.
24 months
From analyst sign-off date
Audited control-by-control by a Finnovia analyst. Only verified ratings are published.
Finnovia's automated review checks the consistency and plausibility of submitted answers against the evidence provided — for example, flagging an answer scored "Optimised" with no supporting document attached, or evidence that doesn't match the maturity level claimed. This is a consistency check, not an independent audit: it improves confidence that the self-declared score is internally coherent, but it does not verify the evidence itself against external reality.
Three levels of assurance: self-assessment, automated AI review, and a rating verified by a Finnovia analyst.
// OUR COMMITMENTS //
Finnovia's methodology is built on transparency and rigor:
Public weights — domain weights are openly communicated.
Deterministic scoring — identical answers always produce identical scores. No subjective factors.
Regulatory alignment — questionnaires exhaustively cover each framework's requirements.
Independent verification — submitted assessments can be verified by a Finnovia analyst before publication.
// READY TO GET YOUR RATING //
Start with the free Discovery tier. Upgrade to a verified rating whenever you're ready.