When is a DORA readiness gap blocking, and who must hear about it?

Start

An item is rated below Operating, or a test finds a weakness

Operating means working in full and meeting its own target, with records a supervisor could sample. Below that are In place (documented and working, but incomplete, short of target or thin on records), Planned (owner and approach agreed) and Not started. When in doubt, choose the lower level. Every item below Operating, and every test finding, is a gap.

• Then: Does the duty apply to you at all?

Decision

Does the duty apply to you at all?

Not applicable is for a duty that does not apply to your profile, with the reason recorded and confirmed with counsel. It is never chosen because the duty is hard or costly (DR-03). If you are not sure, treat the duty as applying (judgement).

• No, with the reason: Not applicable: record why, and have counsel confirm
• Yes, or not sure: Does the gap come from the readiness self-assessment?

Outcome

Not applicable: record why, and have counsel confirm

It is not a gap and counts neither for nor against the result. Reviewing the reason whenever you review the scope assessment is a judgement, because a change in your type, size or TLPT identification can make the duty apply (DR-01). An organisation that only supplies ICT services to a financial entity does not run the readiness assessment (DR-22).

Decision

Does the gap come from the readiness self-assessment?

A self-assessment gap takes its priority from the item's level. A weakness found by a test, an audit, a post-incident review or a supervisor goes in the same tracker with a different source, and you choose its priority from the description that fits. Every test finding goes in the tracker with an owner, a priority and a due date.

• Yes: self-assessment: Is the item binding on your entity type?
• No: test, audit or other finding: Is a duty that binds you not in place at all?

Decision

Is a duty that binds you not in place at all?

The description of Priority 1 is a duty that binds the entity and is not in place at all. If the finding fits it, choose Priority 1. If you are not sure, choose it. The pack's rule sends any gap rated Priority 1, whatever its source, by the same route to the management body as a blocking gap.

• Yes, or not sure: Blocking gap: Priority 1, in the tracker today, close in 30 days
• No: Choose Priority 2 or 3 by the description that fits

Step

Choose Priority 2 or 3 by the description that fits

Priority 2 is a binding duty that is in place but not operating, so that a request for evidence of implementation would find it incomplete. Priority 3 is any other item. Give the finding one owner and a due date. A person other than the one who fixed the weakness confirms that it is fully addressed before it is Done.

• Then: Report the counts to the management body with each assessment

Decision

Is the item binding on your entity type?

An item is binding when at least one of its requirements applies to your profile and is a duty, not an option. In the pack's example the information-sharing item is not binding, because taking part is optional, and neither is the item for evidence ready for the authority. Items you add for national law count as binding duties. If you are not sure, treat it as binding (judgement).

• Yes, or not sure: Is it rated Not started or Planned?
• No: Priority 3: improvement, close within 180 days

Decision

Is it rated Not started or Planned?

A binding item below In place is a blocking gap, because the duty is not in place at all. A binding item that is In place is not blocking, although a request for evidence of implementation would find it incomplete. If you cannot show that it is in place, rate it lower.

• Yes, or not sure: Blocking gap: Priority 1, in the tracker today, close in 30 days
• No: it is In place: Priority 2: exposed on request, close within 90 days

Step

Blocking gap: Priority 1, in the tracker today, close in 30 days

Enter it in the gap tracker as Priority 1 on the day it is found. One blocking gap makes the whole result Not ready. The pack's default is to close it within 30 days of the assessment, or by an earlier date a plan already set. Give it one owner, an effort and the change that closes it. Incident decisions and clocks stay with P09 and P18.

• Then: Does the management body meet within 10 working days?

Decision

Does the management body meet within 10 working days?

The pack counts Monday to Friday, and leaves public holidays for you to allow for. The pack defines the management body as the body that effectively runs the entity or has key functions under the law that governs it, such as the board. Confirm with counsel which body and which chair your law means. The 10 working days is the pack's default. If no meeting date is set, take the no branch (judgement).

• Yes: Take it to the management body at that meeting
• No, or no date set: The DORA programme lead tells the chair within 10 working days

Step

Take it to the management body at that meeting

Put it on the agenda with its owner, due date and the decision you need. In the pack's example the two blocking gaps need a contract amendment signed (GAP-07) and an exit plan written, approved and tested (GAP-08). The Summary sheet has a place to record who reported to the body and when.

• Then: Does your authority or national law require you to tell it?

Step

The DORA programme lead tells the chair within 10 working days

Where the next meeting is more than 10 working days away, the DORA programme lead tells the chair within that time. What to give the chair is a judgement: the gap, its owner, its due date and the decision needed. In the pack's example, an assessment on 30 September 2026 and a board meeting on 22 October 2026, 16 working days later, send the gap to the chair by 14 October 2026. The gap still goes to the management body at its next meeting.

• Then: Does your authority or national law require you to tell it?

Decision

Does your authority or national law require you to tell it?

The pack does not name a duty to tell the supervisor about a readiness gap, and it states no clock. Duties that do reach the authority sit elsewhere in the pack, such as the register of information, telling the authority in good time about a planned critical or important arrangement, and major incident reports. National law and the authority's own instructions may add more, and the pack leaves them as placeholders (DR-21). If you are not sure, ask.

• Yes, or not known: Take counsel's advice before the next report to the authority
• No: Report the counts to the management body with each assessment

Outcome

Take counsel's advice before the next report to the authority

Ask counsel, and your authority where appropriate, whether the gap must be notified and by when. Record the answer with the gap. Do not restate or invent a reporting clock: P18 holds the DORA reporting duties and P09 the decision rights.

Step

Priority 2: exposed on request, close within 90 days

The duty is in place but not operating, so a request for evidence of implementation would find it incomplete. The pack's default is to close it within 90 days of the assessment, or by an earlier planned date. Give it one owner, an effort and the change that closes it.

• Then: Report the counts to the management body with each assessment

Step

Priority 3: improvement, close within 180 days

Any other item below Operating. The pack's default is to close it within 180 days of the assessment, or by an earlier planned date. It is not a blocking gap. A result of Ready, with actions needs no blocking gap anywhere in the assessment.

• Then: Report the counts to the management body with each assessment

Outcome

Report the counts to the management body with each assessment

Report open gaps by priority, with those past their due date named, together with the readiness counts. Do this each time you assess, at least every 6 months by the pack's default, and on the interval your reporting calendar sets. Counts with names only, never a score. Dropping a gap needs the management body's recorded reason.