How do we get ready for a supervisor's request for DORA evidence?

Start

A DORA supervisor may ask us for evidence

DORA expects the entity to give its competent authority complete and updated information on its ICT risk and its framework on request, including the review report in a searchable electronic format. The pack turns this into a list of 34 records, each tied to the requirement that asks for it. Be ready with the records that show each duty operating as well as the policies.

• Then: Are you a financial entity in scope, from a written assessment?

Decision

Are you a financial entity in scope, from a written assessment?

DORA binds financial entities only, and what it asks of one depends on its type, framework and size. A supplier of ICT services to a financial entity is not one. Only a written scope assessment, approved by the management body and confirmed by counsel, settles which you are.

• Yes: Copy your profile into the checklist
• No: we only supply ICT services to one: Check your contracts against the supplier flow-down list
• No, or not known: Settle scope and framework first

Outcome

Check your contracts against the supplier flow-down list

A supplier does not complete the checklist or the readiness assessment. DORA's duties for the contract fall on the financial entity, which must ask the supplier for the terms and information on the flow-down list. Check your customers' contracts and the information you give against its 10 items.

Outcome

Settle scope and framework first

Run the scope assessment, have counsel confirm it, and take it to the management body. Without it you cannot say which of the 34 records apply to you, and the first record on the list (EV-01, the approved scope assessment) is missing.

Step

Copy your profile into the checklist

Enter the entity type, the framework, microenterprise status and TLPT identification from the scope assessment. The checklist then shows which records apply. In the pack's table a full-framework entity owes 33 of the 34 records and one identified for TLPT owes all 34, while a simplified-framework microenterprise owes 19.

• Then: Find your authority's channel, format and language

Step

Find your authority's channel, format and language

Note the competent authority for your type of entity, how it receives requests and records, the format and the language. The pack states none of these, because national law and the authority's own instructions set them. Add any record your law or your authority asks for on the blank rows at the foot of the checklist.

• Then: Go through the records, area by area

Step

Go through the records, area by area

The 34 records fall in six areas: scope and proportionality (1), ICT risk management (16), incident management and reporting (3), resilience testing (4), third-party risk (9) and information sharing (1). Take each record that applies through the questions that follow. A small entity may answer several records with one document, such as a framework with its policies as sections. Name it against each record it answers.

• Then: Does a requirement that applies to you ask for this record?

Decision

Does a requirement that applies to you ask for this record?

The checklist works this out from your profile. Answer no only where the profile removes the duty behind the record, for example the TLPT record when no authority has identified you. A record is never Not applicable because it is hard or costly (DR-03). When you are unsure, treat it as applying (judgement).

• No: the profile removes it: Mark it Not applicable, with the reason the profile gives
• Yes, or not sure: Does the record itself exist?

Step

Mark it Not applicable, with the reason the profile gives

The pack asks for the reason the profile gives to be written down, and the profile to be confirmed with counsel. Expect a supervisor to ask why a record is marked Not applicable (judgement). Look again at the next check, because a record can start to apply when your profile changes (DR-18).

• Then: Count, sign off, and repeat with each self-assessment

Decision

Does the record itself exist?

Open the record and look; do not rely on what people say. Keep the records that show the item operating, such as minutes, test results, logs and acknowledgements. A policy without them shows that the policy exists, and no more. A record that does not exist is Not ready; one that exists in part is Partly ready.

• Yes: Is it complete and current?
• Partly, no, or not known: Not fully ready: write what is missing and raise a gap

Decision

Is it complete and current?

The pack's Ready means the record exists, covers the whole item, is current, and could be produced in time. A record that covers only part of the item, or is out of date, is Partly ready. The pack's example (GAP-05) is a gateway behind a critical function whose test was last run on 29 Aug 2025, more than a year before the assessment.

• Yes: Could its owner hand it over within 5 working days?
• Partly, no, or not known: Not fully ready: write what is missing and raise a gap

Decision

Could its owner hand it over within 5 working days?

The 5 working days is the pack's default (DR-19). Confirm it with counsel and your competent authority, because the authority may set another. The owner must know where the record is. Where a service provider holds the record, it counts only if you can obtain it in time, so put that right in the contract. Keep a copy of the checklist and the records it points to where you can reach them during an ICT disruption.

• Yes: Ready: one named owner, and where it is kept
• Partly, no, or not known: Not fully ready: write what is missing and raise a gap

Step

Ready: one named owner, and where it is kept

Name the person who keeps the record current and would hand it over, say where it is kept, and enter the date of the record. The checklist adds the keep-until date from the retention period you set. Keep superseded versions, marked as such, so you can show what applied on a given day.

• Then: Count, sign off, and repeat with each self-assessment

Step

Not fully ready: write what is missing and raise a gap

Write the fact that is missing in the note, then enter a gap in your own tracker and write its ID against the record. Each gap has one owner, a priority, a due date and the change that closes it. The pack's readiness item for supervision is Operating only when every record not fully ready has its gap in the tracker (SV-01).

• Then: Count, sign off, and repeat with each self-assessment

Outcome

Count, sign off, and repeat with each self-assessment

Report the records ready, partly ready and not ready as counts with names, never as a score or a share (DR-04). The readiness item for supervision (SV-01) is Operating when every record that applies has an owner and every record not fully ready is in the gap tracker. Report the counts to the management body each time (DR-18). Repeat at least every 6 months by the pack's default, and when the profile, the register or a critical or important contract changes.