DORA ICT Risk & Resilience Readiness — Guide
- Version 1.1
- Updated
- Next review
DORA ICT Risk & Resilience Readiness
DORA is the Digital Operational Resilience Act, Regulation (EU) 2022/2554. It applies from 17 January 2025. It asks a financial entity to run its ICT, the information and communication technology behind its services, so that it can withstand, respond to and recover from disruption. It has five pillars. Every financial entity meets the same five, and the depth of each depends on what the entity is. So the first question is what you are, the second is which duties that makes yours, and only then is it worth asking how ready you are. This pack takes you through those three in order, and ends with a position your management body can act on.
Is this for you?
This pack is for you if:
- you work at a financial entity, and nobody has written down which parts of DORA apply to it and why;
- you have a register of ICT suppliers that is a contract list, and nobody has checked it against what DORA asks for;
- your board has not approved the ICT risk framework in terms a supervisor could read in the minutes;
- you supply ICT services to a financial entity, and its contract terms and information requests are landing on your desk.
What DORA asks of an entity
The first row below is the foundation. The five pillars follow it.
| Pillar | What it asks | Where the pack helps |
|---|---|---|
| Scope and proportionality (Articles 2, 4 and 16) | Know whether DORA binds you, and apply its rules in proportion to your size, risk and complexity | The scope assessment |
| ICT risk management (Articles 5 to 16) | A documented framework that the management body defines, approves and oversees, with tested continuity and recovery | The framework template and the readiness self-assessment |
| ICT-related incidents (Articles 17 to 23) | A process to manage and classify incidents, and to report major ones | The regulatory incident notification pack and the incident management pack |
| Resilience testing (Articles 24 to 27) | A risk-based testing programme, with every system behind a critical or important function tested at least yearly | The testing programme |
| ICT third-party risk (Articles 28 to 30) | A register of every ICT arrangement, contract terms, exit plans and oversight of subcontracting | The third-party register and the article library |
| Information sharing (Article 45) | An option to share cyber threat information in trusted communities, and a duty to tell the authority if you join | A recorded decision, tracked in the self-assessment |
DORA’s text asks for each of these in Articles 5(2), 6(1), 11(6), 17(1), 19(1), 24(6), 26(1), 28(3), 30(3) and 45. The article library gives the sense of each and says what you should be able to show a supervisor. It does not say which ISO/IEC 27001 control or NIST CSF outcome meets a DORA requirement, because that would be a claim this pack cannot back.
DORA also sits beside the NIS2 Directive. Article 1(2) says that, for a financial entity that NIS2 would treat as essential or important, DORA is a sector-specific Union act for the purposes of NIS2 Article 4. If that applies to you, read the NIS2 pack with counsel beside this one.
What you are decides what you owe
DORA does not ask the same of everyone. The scope assessment settles four things, and the rest of the pack reads from the result.
| If you are | What changes |
|---|---|
| A financial entity under the full framework | Articles 5 to 15 apply in full |
| An entity that Article 16(1) names: a small and non-interconnected investment firm, an exempted payment institution, an exempted electronic money institution, certain institutions exempted under Directive 2013/36/EU, or a small pension institution | Articles 5 to 15 do not apply. You follow the simplified framework of Article 16 |
| A microenterprise (fewer than 10 persons and a turnover or balance sheet of no more than EUR 2 million) | Several duties do not apply, and the Regulation says where |
| Identified by a threat-led penetration testing authority | You owe advanced testing at least every 3 years. Article 16 entities and microenterprises never do |
| Excluded by Article 2(3) | DORA does not apply. Record why |
Proportionality (Article 4) means the same duty can look different at a large bank and at a small payment institution. Record where you applied a lighter or heavier measure and the reason. Do not mark a requirement Not applicable because it is hard or costly (DR-03). Mark it only when your profile says it does not apply to you.
Who DORA binds, and where a supplier fits
DORA binds financial entities: the kinds listed in Article 2(1), points (a) to (t), less those that Article 2(3) excludes. An ICT third-party service provider is listed in point (u), and is not a financial entity.
If you supply ICT services to a financial entity, DORA reaches you through the contract the entity must write under Article 30 and the information the entity must put in its register under Article 28(3). If the European Supervisory Authorities designate you as critical, a Lead Overseer also oversees you. The scope assessment returns the flow-down list FD-01 to FD-10 for a supplier: the contract terms and the information you should expect to be asked for. A supplier does not run the readiness assessment (DR-22).
Nothing here says that DORA applies to you. The scope assessment decides, counsel confirms, and where your competent authority tells you something different, its view stands (DR-01).
The order to work in
Work through S-1 to S-8 in order, unless a duty with a date forces another order (DR-02). Each step settles named readiness items, and the self-assessment rates those in words.
| Step | What to do | Why this step is here | Documents |
|---|---|---|---|
| S-1 | Decide what you are | Every other duty depends on the answer, and the assessment is short | Scope assessment; article library |
| S-2 | Put the management body in charge | The decisions are the management body’s, so the later approvals need it ready | Briefing deck; framework template |
| S-3 | List what you depend on | Functions, assets and the register of ICT arrangements come first, and provider identifiers take weeks to collect | Third-party register; evidence checklist |
| S-4 | Write and approve the framework | It sets the tolerance, the continuity plans and the control functions that tests and contracts then use | Framework template |
| S-5 | Close the gaps in critical or important arrangements | These are the duties a supervisor tests first: contract terms, exit plans and subcontracting | Third-party register; article library; gap tracker |
| S-6 | Make classification and reporting ready and rehearsed | A major incident starts a clock that does not wait for the programme | P18 and P09, then the self-assessment |
| S-7 | Plan and run the tests | The yearly tests need the list of critical or important systems from step S-3 | Testing programme |
| S-8 | Gather the evidence, review and report | Evidence is what is left to show once the work is done, and the cycle repeats | Evidence checklist; self-assessment; gap tracker; briefing deck |
Run the readiness self-assessment once after S-3 to see where you stand, and again after each later step. Repeat it at least every 6 months, and whenever your profile, your register or a critical contract changes (DR-18).
Start with these three
- DORA Proportionality & Scope Assessment: what you are, which duties follow, and the reasons, ready for counsel and the management body.
- ICT Third-Party Arrangements Register — Working Copy: every arrangement listed and checked before you judge any of them, because provider identifiers take the longest to collect.
- DORA Readiness Self-Assessment: each readiness item rated from Not started to Operating, and the blocking gaps named.
How it runs in practice (EXAMPLE)
Take Lantern Pay Services, a fictional small authorised payment institution with 64 staff. Its board has five members. It is a payment institution that is not exempted, so it follows the full framework. With 64 staff it is not a microenterprise, and no authority has identified it for threat-led testing. Of the 52 requirements in the article library, 41 apply to it and 11 do not.
On 30 September 2026 its Head of Compliance rated the 19 readiness items that apply. Eleven are Operating, 6 are In place and 2 are Planned. The result is Not ready, with 2 blocking gaps: contract terms (TP-04) and exit plans and subcontracting (TP-05). Both concern one arrangement, the payment platform, signed in 2022. Its contract lacks the audit, access and testing terms of Article 30(3), and it has no exit plan. Both are due on 30 October 2026 or earlier. Six other items sit below Operating.
The board meets on 22 October, 16 working days away. That is more than the 10 working days that DR-05 allows, so the programme lead tells the chair by 14 October. The rest of the position is in counts with names. One of 7 arrangements has a register finding, because a hosting subcontractor has no legal entity identifier. Four of 5 systems behind the critical function were tested in the last 12 months. Four of 5 board members have had their training, and the fifth is booked. Twenty-five of 33 evidence items are ready. Eight gaps are open, 2 at Priority 1 and 6 at Priority 2, and none is overdue. The yearly test of the continuity plans is overdue, and a gap tracks it.
Your first month
| When | What to do | You’re done when |
|---|---|---|
| Week 1 | Run the scope assessment (S-1) and take it to counsel. | The decision is written down, with its reasons, and the management body has approved it. |
| Week 2 | Brief the management body on its duties (S-2). List your critical or important functions and the people who own them. | The functions have owners, and each has a reason recorded. |
| Week 3 | Start the register (S-3): every arrangement, including intra-group and small or free services. Ask each provider for its identifier. | Every arrangement is listed, and each missing identifier has a request out. |
| Week 4 | Run the readiness self-assessment and enter each gap in the tracker. | Each gap has an owner, a priority and a due date. |
What to report to the management body
Report these every time you repeat the self-assessment, as counts with names:
- readiness items at each level, with the item names beside each count;
- blocking gaps, with owners and due dates;
- arrangements with an open register finding;
- exit plans in place for critical or important arrangements;
- systems tested in time, and those that were not;
- gaps open and overdue, by priority;
- management body members trained;
- evidence items ready, and those that are not.
A blocking gap goes to the management body at its next meeting. If that meeting is more than 10 working days away, the programme lead tells its chair within that time (DR-05). Report counts, never a percentage, a score or a traffic-light total (DR-04).
Everything in the pack
| Document | What it does | Format |
|---|---|---|
| DORA Proportionality & Scope Assessment | Your entity type, your regime and the requirements that follow | Excel |
| DORA Article-to-Control Mapping Library | Each requirement in plain words, what to be able to show, and the CISO Times documents that help | Excel |
| DORA Readiness Self-Assessment | Readiness by item, in words, with blocking gaps named | Excel |
| ICT Risk Management Framework Document Template | The framework your management body approves, with its review record | Word |
| ICT Third-Party Arrangements Register — Working Copy | Your register in the implementing standard’s columns, with checks | Excel |
| Digital Operational Resilience Testing Programme | The tests you plan, who runs them and when each is due | Excel |
| DORA Documentation & Evidence Checklist | What a supervisor may ask for, who owns it and where it is | Excel |
| DORA Gap & Remediation Tracker | Gaps into owned, dated actions | Excel |
| Management Body DORA Briefing Deck | Duties, position and decisions, for the management body | PowerPoint |
Use them in this order: the scope assessment, the article library to read your duties, the briefing deck, the register, the framework template, the self-assessment, the testing programme, then the evidence checklist, with the gap tracker alongside from the first assessment. The sequence above says which step each serves.
Limits
- Not legal advice. This pack helps you see what DORA asks of an entity like yours and what you can show. It is not legal advice, and following it is not a statement that you comply with DORA or any standard. Whether DORA binds you, and which of its duties apply to you, depends on what you are, how you are authorised and how your Member State and your supervisor apply it. Confirm it with counsel or your competent authority.
- No mapping. The article library does not say which ISO/IEC 27001 controls or NIST CSF outcomes meet a DORA requirement. It gives each requirement’s own words, what an entity must be able to show, and the CISO Times documents that help with the work. Where the CISO Times Library holds a mapping between a DORA requirement and a control, it shows it there with how closely the two match and where they differ; confirm it against both texts before relying on it. A document listed as helping does not by itself show that a requirement is met.
- Reporting and recovery belong to other packs. The incident management pack (P09) owns incident response and every decision right, clock and recovery criterion. The regulatory incident notification pack (P18) holds the DORA classification test and reporting duties. The recovery pack (P22) owns recovery objectives and the recovery test (RR-14), and the backup pack (P23) owns the backup standard and the restore tests. This pack states no reporting clock and counts those tests by ID only (DR-13, DR-15).
- Exercises are not tests. A tabletop exercise (P10) tests decisions. It is never counted as a test of a system (DR-13).
- Your authority sets the details. The competent authority, its channels, the dates and format for the register and for reports, and anything national law adds are placeholders you fill from your authority’s own instructions (DR-21). The register here is a working copy: the official submission format follows the implementing standard.
- One entity. The documents work at the level of one entity. A group keeps the register at sub-consolidated and consolidated level too, and takes advice on that (DR-23).
- The files are yours. Every register, checklist, tracker and plan in the pack is a file you keep on your own systems. Nothing you enter in them goes back to the CISO Times.
- The example is not a real firm. Lantern Pay Services is fictional, marked EXAMPLE, and every value in it is made up.
Where it maps
- DORA (Regulation (EU) 2022/2554): Articles 1(2), 2(1), 2(3), 4, 5(2), 6(1), 11(6), 16(1), 17(1), 19(1), 24(6), 26(1), 28(3), 30(3), 45 and 64.
- ISO/IEC 27001:2022: Annex A 5.31, Legal, statutory, regulatory and contractual requirements. This names the control the guide relates to. It does not say that meeting it meets any DORA requirement.
- NIST CSF 2.0: GV.OC-03.
What changed
Each change to this pack's documents since it was published, newest first.Changes across all packs
The note on mappings says that where the CISO Times Library holds a mapping between a DORA requirement and a control, it shows how closely the two match and where they differ, and to confirm it against both texts before relying on it, instead of a verification state.
- Guide 1.0 → 1.1
The mappings note no longer says the CISO Times Library shows a verification state; it says what a mapping shows and to confirm it against both texts.
- DORA Proportionality & Scope Assessment 1.1 → 1.2
- DORA Article-to-Control Mapping Library 1.3 → 1.4
- DORA Readiness Self-Assessment 1.2 → 1.3
- ICT Risk Management Framework Document Template 1.1 → 1.2
- ICT Third-Party Arrangements Register — Working Copy 1.1 → 1.2
- Digital Operational Resilience Testing Programme 1.0 → 1.1
- DORA Documentation & Evidence Checklist 1.1 → 1.2
- DORA Gap & Remediation Tracker 1.1 → 1.2
- Management Body DORA Briefing Deck 1.1 → 1.2
IM-01 and IM-02's "Operating when" no longer print an internal code name; they name the incident checks.
- DORA Readiness Self-Assessment 1.1 → 1.2
The Supporting Documents sheet no longer repeats each document's pack name in a column of its own, which the document ID already gives.
- DORA Article-to-Control Mapping Library 1.2 → 1.3
A financial entity that sells ICT services is also a supplier, and any Priority 1 gap goes to the chair route.
- DORA Proportionality & Scope Assessment 1.0 → 1.1
- DORA Article-to-Control Mapping Library 1.1 → 1.2
- DORA Readiness Self-Assessment 1.0 → 1.1
- ICT Risk Management Framework Document Template 1.0 → 1.1
- ICT Third-Party Arrangements Register — Working Copy 1.0 → 1.1
- DORA Gap & Remediation Tracker 1.0 → 1.1
- Management Body DORA Briefing Deck 1.0 → 1.1
Lists the P26 documents among the supporting documents.
- DORA Article-to-Control Mapping Library 1.0 → 1.1
- DORA Documentation & Evidence Checklist 1.0 → 1.1
Published. The guide and nine documents, at 1.0.