Does our ISO 27001 certificate satisfy DORA's ICT risk management framework?

Start

We hold an ISO 27001 certificate and DORA may bind us

A certificate is evidence about an information security management system, and DORA asks about an ICT risk management framework with contents its articles name. The subjects overlap, but the pack does not say that one meets the other (DR-20). So the useful question is which DORA requirements your records already show, and which they do not.

• Then: Does our scope assessment show that DORA binds us?

Decision

Does our scope assessment show that DORA binds us?

DORA binds the financial entities of Article 2(1), points (a) to (t), less those excluded. A certificate says nothing about that. If you have no approved scope assessment, or its answer is unclear, take No and settle scope first.

• Yes: Mark which of the 52 requirements apply to our profile
• No, or not yet assessed: Settle scope first, then come back

Outcome

Settle scope first, then come back

Whether DORA binds you, and under which framework, decides which requirements you read at all. If you supply ICT services to a financial entity, you do not run this check, and DORA reaches you through your customers' contracts (DR-22). Return here once the profile is approved.

Step

Mark which of the 52 requirements apply to our profile

Use the Applies to us column of the Requirement Library, from your scope assessment. The full framework puts the ICT risk management rows at RQ-04 to RQ-22. An Article 16 entity reads RQ-03, RQ-23 to RQ-26 and RQ-40 instead, and a microenterprise sees several rows lighten. A requirement is never marked Not applicable because it is hard or costly (DR-03).

• Then: Does the certificate's scope cover every system the framework needs?

Decision

Does the certificate's scope cover every system the framework needs?

The certificate names its scope, and an auditor tested that scope. DORA's framework is described by the Regulation: it protects all information assets and ICT assets, including physical premises (RQ-07), and covers every ICT-supported function and its dependencies (RQ-12). Compare the two lists. Anything in DORA's reach outside the certified scope has not been through your ISMS audit.

• Yes: For each applicable requirement, list the records we hold
• No, or not known: Note each uncovered entity, system or service as a gap

Step

Note each uncovered entity, system or service as a gap

List what is inside DORA's reach and outside the certificate: a business line, an acquired system, an ICT service you run through a provider. Enter each in your gap tracker with an owner, an effort and a due date. Extending the ISMS scope is one way to close the gap. That choice is yours, and the pack takes none.

• Then: For each applicable requirement, list the records we hold

Step

For each applicable requirement, list the records we hold

In the Requirement Library, fill Your policies, procedures and records and one owner for every row that applies. Then test each row with What to be able to show: could you hand a supervisor each of those records today? If you run ISO controls for a requirement, note them in your own-entry column. That entry is your judgement, to check with your auditor or counsel. The pack fills none.

• Then: Can we show the management body owns and approves the framework?

Decision

Can we show the management body owns and approves the framework?

Judgement: we check four areas first because the text there names specific approvals, registers, contract terms and reports. The pack does not rank them. Article 5 gives the management body the framework, strategy, risk tolerance, continuity policy, audit plans and budget. Look for minutes that name each item (RQ-04), reports it received (RQ-05), member training (RQ-06), the yearly review report (RQ-09) and the resilience strategy (RQ-10).

• Yes: Do we have the register of information and the contract terms?
• No, or not known: Raise a gap for each missing approval, report or record

Step

Raise a gap for each missing approval, report or record

Name which of RQ-04, RQ-05, RQ-06, RQ-09 or RQ-10 is short and what record would close it, such as minutes that list each item the management body approved (DR-07). The management body is the board, the management board in a two-tier structure, or executive management where there is no board. Hold its next approval to the DORA list in DR-07.

• Then: Do we have the register of information and the contract terms?

Decision

Do we have the register of information and the contract terms?

DORA asks for a register of every ICT third-party arrangement in the format of Implementing Regulation 2024/2956 (RQ-42, RQ-43), contract terms for each arrangement and more for critical or important functions (RQ-47, RQ-48), exit plans (RQ-49) and subcontracting terms (RQ-50). Judgement: a supplier list kept for the ISMS may be a starting point, but the register has set fields and provider identifiers such as an LEI or EUID.

• Yes: Can we classify incidents and report major ones to the authority?
• No, or not known: Raise gaps for the register, contract terms and exit plans

Step

Raise gaps for the register, contract terms and exit plans

Enter each missing item as its own gap. The register comes first, and it lists every arrangement before you judge any of them (DR-08). For arrangements that support a critical or important function, the register assessment, Article 30(3) terms, exit plan, subcontracting assessment and concentration check are all needed (DR-11). A live contract does not wait for renewal.

• Then: Can we classify incidents and report major ones to the authority?

Decision

Can we classify incidents and report major ones to the authority?

RQ-27 to RQ-29 ask for a process that logs every ICT incident, classifies each against Delegated Regulation 2024/1772 and reports major ones to the competent authority on set templates. Check that the authority, channel, templates and signatories are ready (IC-03, IC-04). The clocks sit in P09 and P18, and this flow states none.

• Yes: Do we run the testing our profile requires, by independent testers?
• No, or not known: Raise gaps for classification, channels and rehearsal

Step

Raise gaps for classification, channels and rehearsal

Enter what is missing: the classification record for each incident, the named authority and channel, the templates, the signatories and their tested access, and the client notice (IC-01 to IC-08). Take the decision rights and clocks from P09 and the DORA reporting facts from P18, and cite them by ID in your procedure instead of copying them.

• Then: Do we run the testing our profile requires, by independent testers?

Decision

Do we run the testing our profile requires, by independent testers?

Entities other than microenterprises need an approved programme, tests by independent parties and a yearly test of every system behind a critical or important function (RQ-32, RQ-33). A microenterprise follows a risk-based plan (RQ-35). Whether an ISMS scan or audit counts is for you to judge against the test record: independent of those who build or run the system, held, dated and recorded (DR-12). An exercise is not a test (DR-13). TLPT applies only if identified (DR-16).

• Yes: Is any binding duty not in place at all?
• No, or not known: Raise gaps for the programme, yearly tests and findings

Step

Raise gaps for the programme, yearly tests and findings

Enter each system with no counting test in the last 12 months (the pack's default), and each finding without an owner, priority and due date (DR-14). Someone other than the person who fixed a weakness confirms that it is fully addressed (Article 24(5)). Recovery and restore tests are owned by P22 and P23, which this flow does not restate.

• Then: Is any binding duty not in place at all?

Decision

Is any binding duty not in place at all?

Take every row you tested, not only the four areas. A binding duty rated below In place, which means not in place at all, is a blocking gap (DR-05). Count the ones you found and name them, such as 2 of 5. If you could not finish a row, or do not know, treat it as in this group.

• Yes, or not known: Enter as Priority 1 and take it to the management body
• No, but some records are partial: Fix the partial records and re-run the check
• No, every record is ready: Keep the records: this is a count, not a finding of compliance

Outcome

Enter as Priority 1 and take it to the management body

Enter each blocking gap in your tracker as Priority 1 on the day you find it, due within 30 days by the pack's default (DR-06). It goes to the management body at its next meeting. By the pack's default, if that meeting is more than 10 working days away, the DORA programme lead tells its chair within that time (DR-05). The certificate does not change this.

Outcome

Fix the partial records and re-run the check

A binding duty that is In place but not Operating is Priority 2: a request for evidence would find it incomplete. Any other item below Operating is Priority 3. Give each gap an owner, an effort and a due date (DR-06). The pack's default periods are 30, 90 and 180 days for Priorities 1 to 3. Re-rate at your next self-assessment, every 6 months by default (DR-18).

Outcome

Keep the records: this is a count, not a finding of compliance

If every applicable requirement has records you could hand over, keep them with an owner and a keep-until date. The pack's defaults are to keep each record for at least 3 years and to produce any item within 5 working days of a request (DR-19), and your authority may set longer. Nothing here states that you comply with DORA or that the certificate meets a requirement. Repeat when the profile, register or a critical contract changes.