DORA Documentation & Evidence Checklist

Lists the policies, registers and records supervisors expect, with owner and status per item.

Available soon

Format: Excel
Size: 89 KB
Length: 12 sheets
Version: 1.2
Updated: 8 Oct 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.214 Oct 2026
The mappings note no longer says the CISO Times Library shows a verification state; it says what a mapping shows and to confirm it against both texts.
1.110 Oct 2026
Lists the P26 documents among the supporting documents.
1.08 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Use this workbook with the DORA Proportionality & Scope Assessment and the DORA Readiness Self-Assessment. Read the Records Explained sheet once: it says what each record is, which requirements ask for it and what a supervisor should be able to see.
2	Fill "Your profile" at the top of the Checklist sheet. Copy the entity type, the framework, the microenterprise answer and the TLPT answer from your DORA Proportionality & Scope Assessment. Say how long you keep records (DR-19). The Who It Binds sheet shows which records each kind of entity owes.
3	Read the Applies? column. It works out, for each record, whether a requirement that applies to your profile asks for it. A record that does not apply reads Not applicable. Never mark a record Not applicable because it is hard or costly (DR-03).
4	For each record that applies, look at the record itself. Choose the Status: Ready, Partly ready or Not ready. The record exists, covers the whole item, is current, and its owner could hand it over in time (DR-19).
5	Name the owner: the person who keeps the record current and would hand it over. Say what the record is and where it is kept, and enter the date of the record and the date you checked it.
6	For every record that is Partly ready or Not ready, write in the Note what is missing, then enter its gap in the DORA Gap & Remediation Tracker and write the gap ID in the Gap ID column. The Check column tells you what is still missing on each row.
7	Read the Keep until column. It adds the retention period to the date of the record. The Retention sheet says how to set the period, where each period starts and how to be able to produce a record (DR-19).
8	Read the counts at the top. They show how many records are ready, partly ready and not ready, area by area, and name the records still open. They also show the level of readiness item SV-01 and the fact to copy into the DORA Readiness Self-Assessment. Do not turn the counts into a score or a share (DR-04).
9	Repeat the check with each readiness self-assessment, at least every 6 months, and whenever the profile, the register or a critical or important contract changes (DR-18). Add records of your own on the yellow rows at the foot of the table, for example records your national law or your authority asks for (DR-21).
10	To clear the EXAMPLE, delete the EXAMPLE Checklist sheet. The Checklist sheet is already blank. The records stay: they are the pack's list.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

DR-19: Keep the records behind each evidence item for at least [[3]] years, unless a duty or your competent authority says longer, and be able to produce any item within [[5]] working days of a request.

DR-03: Read every requirement from your own profile. A requirement that does not apply to you is marked Not applicable with the reason the profile gives. A requirement is never marked Not applicable because it is hard or costly.

DR-04: Readiness is a count with names, such as 2 of 5, and one of three result words. It is never a score, a percentage or a traffic-light total.

DR-18: Repeat the readiness self-assessment at least every [[6]] months, and whenever the profile, the register or a critical or important contract changes. Report the counts to the management body each time.

Status. Not applicable: the profile means the duty behind the record does not apply. Not ready: the record does not exist. Ready: it exists, is complete and current, and can be produced in time. Partly ready: any other case. Not assessed: the record applies and has no status yet.

Why a checklist. DORA is one regulation with five pillars: ICT risk management, ICT-related incident management and reporting, digital operational resilience testing, the management of ICT third-party risk, and information sharing. Every financial entity meets the same five pillars, and the depth of each depends on what the entity is. A microenterprise, a small investment firm, an exempted payment institution and a large bank each owe a different part of each pillar, and the Regulation says which. So the first question is what you are, the second is which duties that makes yours, and only then is it worth asking how ready you are. Being ready is a count of duties in place and duties still open. It is never one score.

Who this is for. Financial entities only. If you supply ICT services to a financial entity and are not one yourself, do not complete this checklist (DR-22). The terms your customers must ask for in your contracts are the supplier flow-down list (FD-01 to FD-10) in the Supplier Flow-Down sheet of the DORA Article-to-Control Mapping Library.

This document helps you see what DORA asks of an entity like yours and what you can show. It is not legal advice, and following it is not a statement that you comply with DORA or any standard. Whether DORA binds you, and which of its duties apply to you, depends on what you are, how you are authorised and how your Member State and your supervisor apply it: confirm it with counsel or your competent authority.

EXAMPLE: Lantern Pay Services (EXAMPLE), a small authorised payment institution in an EU Member State, with 64 staff, as at 30 Sep 2026. The EXAMPLE Checklist sheet shows its checklist. Its records, statuses and gaps are the pack's other documents' for it.

Adapting this template.

Smaller entity: one short document can answer several records, such as a single framework document with its policies as sections. Name it against each record it answers. What matters is that each record exists, is current and can be found.

Microenterprise or Article 16 entity: the profile removes the records whose duties do not reach you. The ones that remain are lighter in depth, not in kind: the framework document, the register and the tests still need their records.

IT run by a service provider: records the provider keeps count only if you can obtain them in time. Put that right in the contract, and name the provider's record and who asks for it.

Group: these sheets work at the level of one entity. A group keeps the register at sub-consolidated and consolidated level as well, and takes advice on that (DR-23).

This workbook is your own record. Keep it with your framework document and your gap tracker.

Checklist

Documentation and evidence: [[entity or group]]

One copy of this sheet for each entity. Yellow cells are yours. Applies?, Status now, every count, the keep-until dates and the check calculate. Counts only, never a score.

Your profile

Entity	[[Name of the financial entity]]
Entity type (copy from the scope assessment)		Take these answers from the DORA Proportionality & Scope Assessment. The Who It Binds sheet shows what each answer changes.
Framework (copy from the scope assessment)
Microenterprise?
Identified for TLPT by a TLPT authority?
Date of this check	[[YYYY-MM-DD]]
Keep records for at least (years)	3	The pack's default (DR-19). A duty or your competent authority may require longer.
Produce any record within (working days)	5

Where the records stand

Records ready, partly ready and not ready (of those that apply)			Fill your profile first
Records not fully ready
Readiness item SV-01, evidence ready for the competent authority
The fact to copy into the readiness self-assessment

By area

Area	Records	Not assessed
Scope and proportionality	1	1
ICT risk management	16	16
ICT-related incident management, classification and reporting	3	3
Digital operational resilience testing	4	4
Management of ICT third-party risk	9	9
Information sharing	1	1
All records, including your own	34	34

Counts of records, never a share. A record of your own counts in the last row, and in an area only if its area is one of the above.

The records, EV-01 to EV-34

Item	Area	Readiness item it proves	Record a supervisor may ask for	Asked for by	Usual owner	Applies?	Status now	Check
EV-01	Scope and proportionality	SC-01 Scope, profile and proportionality decided and recorded	The scope and proportionality assessment, approved by the management body	RQ-01, RQ-02	DORA programme lead	Fill your profile	Not assessed	Fill your profile
EV-02	ICT risk management	RM-01 The management body governs ICT risk	Minutes of the management body's approvals and its reports	RQ-04, RQ-05, RQ-26	Management body	Fill your profile	Not assessed	Fill your profile
EV-03	ICT risk management	RM-01 The management body governs ICT risk	The management body's training record	RQ-06	Management body	Fill your profile	Not assessed	Fill your profile
EV-04	ICT risk management	RM-02 The ICT risk management framework is documented, approved and reviewed	The ICT risk management framework document	RQ-03, RQ-07	ICT risk owner	Fill your profile	Not assessed	Fill your profile
EV-05	ICT risk management	RM-02 The ICT risk management framework is documented, approved and reviewed	The latest report on the review of the framework, in a searchable electronic format	RQ-09, RQ-25	ICT risk owner	Fill your profile	Not assessed	Fill your profile
EV-06	ICT risk management	RM-02 The ICT risk management framework is documented, approved and reviewed	The digital operational resilience strategy	RQ-10	ICT risk owner	Fill your profile	Not assessed	Fill your profile
EV-07	ICT risk management	RM-03 ICT risk control, independence and audit	The ICT audit plan, audit reports and follow-up of critical findings	RQ-08	Internal audit	Fill your profile	Not assessed	Fill your profile
EV-08	ICT risk management	RM-04 Functions, assets and dependencies identified and assessed	Inventories of functions, information assets, ICT assets and ICT third-party dependencies	RQ-12, RQ-23	ICT risk owner	Fill your profile	Not assessed	Fill your profile
EV-09	ICT risk management	RM-04 Functions, assets and dependencies identified and assessed	ICT risk assessments for major changes and for legacy systems	RQ-13	ICT risk owner	Fill your profile	Not assessed	Fill your profile
EV-10	ICT risk management	RM-05 Protection, detection and resilient systems	The information security policy and the access, authentication, change and patch policies	RQ-14	ICT risk owner	Fill your profile	Not assessed	Fill your profile
EV-11	ICT risk management	RM-05 Protection, detection and resilient systems	The description of the detection mechanisms, alert thresholds and their tests	RQ-15	ICT risk owner	Fill your profile	Not assessed	Fill your profile
EV-12	ICT risk management	RM-06 Continuity, backup and recovery planned and tested	The ICT business continuity policy, business impact analysis and response and recovery plans	RQ-16, RQ-24	ICT risk owner	Fill your profile	Not assessed	Fill your profile
EV-13	ICT risk management	RM-06 Continuity, backup and recovery planned and tested	Backup policy, restoration procedures and the recovery objectives of each critical or important function	RQ-19	ICT risk owner	Fill your profile	Not assessed	Fill your profile
EV-14	ICT risk management	RM-06 Continuity, backup and recovery planned and tested	Test records for the continuity, response and recovery plans, with the report of deficiencies to the management body	RQ-17, RQ-24	ICT risk owner	Fill your profile	Not assessed	Fill your profile
EV-15	ICT risk management	RM-07 Learning, training and crisis communication	Post-incident review records and the changes they led to	RQ-20	ICT risk owner	Fill your profile	Not assessed	Fill your profile
EV-16	ICT risk management	RM-07 Learning, training and crisis communication	Awareness and digital operational resilience training records	RQ-21	ICT risk owner	Fill your profile	Not assessed	Fill your profile
EV-17	ICT risk management	RM-07 Learning, training and crisis communication	The crisis communication plan and the name of the person tasked	RQ-22	ICT risk owner	Fill your profile	Not assessed	Fill your profile
EV-18	ICT-related incident management, classification and reporting	IM-01 Incidents managed, logged and classified	The incident management procedure and the incident log	RQ-27	Incident manager	Fill your profile	Not assessed	Fill your profile
EV-19	ICT-related incident management, classification and reporting	IM-01 Incidents managed, logged and classified	A classification record for each incident	RQ-28	Incident manager	Fill your profile	Not assessed	Fill your profile
EV-20	ICT-related incident management, classification and reporting	IM-02 Major incidents can be reported on time	The reporting log, with a copy of every report and its time (P18)	RQ-29, RQ-31	Incident manager	Fill your profile	Not assessed	Fill your profile
EV-21	Digital operational resilience testing	RT-01 A risk-based resilience testing programme	The approved testing programme	RQ-32, RQ-34, RQ-35, RQ-36, RQ-40	Resilience testing lead	Fill your profile	Not assessed	Fill your profile
EV-22	Digital operational resilience testing	RT-01 A risk-based resilience testing programme	The register of test findings with priority, owner, due date and validated closure	RQ-32	Resilience testing lead	Fill your profile	Not assessed	Fill your profile
EV-23	Digital operational resilience testing	RT-02 Systems behind critical or important functions tested every 12 months	Test records for each system behind a critical or important function	RQ-33	Resilience testing lead	Fill your profile	Not assessed	Fill your profile
EV-24	Digital operational resilience testing	RT-03 Threat-led penetration testing, if the entity is identified	The TLPT identification, validated scope, summary report, remediation plans and attestation	RQ-37, RQ-38, RQ-39	Resilience testing lead	Fill your profile	Not assessed	Fill your profile
EV-25	Management of ICT third-party risk	TP-01 The register of information is complete and valid	The register of information and the acknowledgement of the latest submission	RQ-42, RQ-43	Third-party arrangements owner	Fill your profile	Not assessed	Fill your profile
EV-26	Management of ICT third-party risk	TP-02 Third-party strategy, policy and monitoring role	The ICT third-party strategy and the policy on critical or important services, with the management body's approval	RQ-44	Management body	Fill your profile	Not assessed	Fill your profile
EV-27	Management of ICT third-party risk	TP-02 Third-party strategy, policy and monitoring role	The designation of the monitoring role or senior manager	RQ-45	Management body	Fill your profile	Not assessed	Fill your profile
EV-28	Management of ICT third-party risk	TP-03 Assessment before contracting, audit and concentration	Pre-contract assessments, due diligence and concentration checks for critical or important arrangements	RQ-46	Third-party arrangements owner	Fill your profile	Not assessed	Fill your profile
EV-29	Management of ICT third-party risk	TP-03 Assessment before contracting, audit and concentration	The check of each provider against the ESAs' list of critical providers	RQ-51	Third-party arrangements owner	Fill your profile	Not assessed	Fill your profile
EV-30	Management of ICT third-party risk	TP-04 Contract terms in place	The contracts, checked against the Article 30 terms	RQ-47, RQ-48	Legal	Fill your profile	Not assessed	Fill your profile
EV-31	Management of ICT third-party risk	TP-05 Exit plans and subcontracting for critical or important arrangements	Exit plans for critical or important arrangements, with review and test records	RQ-49	Third-party arrangements owner	Fill your profile	Not assessed	Fill your profile
EV-32	Management of ICT third-party risk	TP-05 Exit plans and subcontracting for critical or important arrangements	Subcontracting assessments and the record of notified changes	RQ-50	Third-party arrangements owner	Fill your profile	Not assessed	Fill your profile
EV-33	Management of ICT third-party risk	TP-01 The register of information is complete and valid	The record of each planned critical or important arrangement and when the authority was told	RQ-43	Third-party arrangements owner	Fill your profile	Not assessed	Fill your profile
EV-34	Information sharing	IS-01 Information sharing and threat notification: a decision	The decision on information sharing and threat notification, and any notice to the authority	RQ-52, RQ-30	ICT risk owner	Fill your profile	Not assessed	Fill your profile

Sign-off

Role	Name	Date	Signature or reference
Checked (DORA programme lead)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Accepted (Management body)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Next check due	[[With the next readiness self-assessment, within 6 months (DR-18)]]	[[YYYY-MM-DD]]	[[Reference]]

EXAMPLE Checklist

EXAMPLE: Lantern Pay Services, documentation and evidence

Lantern Pay Services (EXAMPLE), a small authorised payment institution in an EU Member State, with 64 staff, as at 30 Sep 2026. Yellow cells are the reader's. Applies?, Status now, the counts, the keep-until dates and the check calculate.

Your profile

Entity	Lantern Pay Services (EXAMPLE)
Entity type (copy from the scope assessment)	Payment institution (including an exempted payment institution)	Take these answers from the DORA Proportionality & Scope Assessment. The Who It Binds sheet shows what each answer changes.
Framework (copy from the scope assessment)	Full ICT risk management framework (DORA Articles 5 to 15)
Microenterprise?	No
Identified for TLPT by a TLPT authority?	No
Date of this check	30 Sep 2026
Keep records for at least (years)	3	The pack's default (DR-19). A duty or your competent authority may require longer.
Produce any record within (working days)	5

Where the records stand

Records ready, partly ready and not ready (of those that apply)			25 of 33 ready; 7 partly ready; 1 not ready; 1 not applicable
Records not fully ready			EV-03, EV-09, EV-14, EV-20, EV-23, EV-25, EV-30, EV-31
Readiness item SV-01, evidence ready for the competent authority			Operating
The fact to copy into the readiness self-assessment			25 of 33 evidence items ready; the 8 not fully ready are each behind a gap in the tracker.

By area

Area	Records	Apply to you	Ready	Partly ready	Not ready	Not applicable
Scope and proportionality	1	1	1	0	0	0
ICT risk management	16	16	13	3	0	0
ICT-related incident management, classification and reporting	3	3	2	1	0	0
Digital operational resilience testing	4	3	2	1	0	1
Management of ICT third-party risk	9	9	6	2	1	0
Information sharing	1	1	1	0	0	0
All records, including your own	34	33	25	7	1	1

Counts of records, never a share. A record of your own counts in the last row, and in an area only if its area is one of the above.

The records, EV-01 to EV-34

Item	Area	Readiness item it proves	Record a supervisor may ask for	Asked for by	Usual owner	Applies?	Status	Status now	Owner	The record, and where it is kept	Date of the record	Keep until	Date checked	Gap ID in the tracker	Note: what is missing	Check
EV-01	Scope and proportionality	SC-01 Scope, profile and proportionality decided and recorded	The scope and proportionality assessment, approved by the management body	RQ-01, RQ-02	DORA programme lead	Yes	Ready	Ready	Head of Compliance	Scope assessment approved on 21 Nov 2024 and reviewed on 4 Mar 2026	4 Mar 2026	4 Mar 2029	30 Sep 2026			OK
EV-02	ICT risk management	RM-01 The management body governs ICT risk	Minutes of the management body's approvals and its reports	RQ-04, RQ-05, RQ-26	Management body	Yes	Ready	Ready	The board				30 Sep 2026			OK
EV-03	ICT risk management	RM-01 The management body governs ICT risk	The management body's training record	RQ-06	Management body	Yes	Partly ready	Partly ready	The board				30 Sep 2026	GAP-01	Four of five members trained; the fifth is booked for 8 Oct 2026	OK
EV-04	ICT risk management	RM-02 The ICT risk management framework is documented, approved and reviewed	The ICT risk management framework document	RQ-03, RQ-07	ICT risk owner	Yes	Ready	Ready	Head of Information Security	Framework approved by the board on 12 Mar 2026	12 Mar 2026	12 Mar 2029	30 Sep 2026			OK
EV-05	ICT risk management	RM-02 The ICT risk management framework is documented, approved and reviewed	The latest report on the review of the framework, in a searchable electronic format	RQ-09, RQ-25	ICT risk owner	Yes	Ready	Ready	Head of Information Security	Review report approved by the board on 12 Mar 2026	12 Mar 2026	12 Mar 2029	30 Sep 2026			OK
EV-06	ICT risk management	RM-02 The ICT risk management framework is documented, approved and reviewed	The digital operational resilience strategy	RQ-10	ICT risk owner	Yes	Ready	Ready	Head of Information Security	Strategy and risk tolerance approved by the board on 12 Mar 2026	12 Mar 2026	12 Mar 2029	30 Sep 2026			OK
EV-07	ICT risk management	RM-03 ICT risk control, independence and audit	The ICT audit plan, audit reports and follow-up of critical findings	RQ-08	Internal audit	Yes	Ready	Ready	Head of Internal Audit				30 Sep 2026			OK
EV-08	ICT risk management	RM-04 Functions, assets and dependencies identified and assessed	Inventories of functions, information assets, ICT assets and ICT third-party dependencies	RQ-12, RQ-23	ICT risk owner	Yes	Ready	Ready	Head of Information Security				30 Sep 2026			OK
EV-09	ICT risk management	RM-04 Functions, assets and dependencies identified and assessed	ICT risk assessments for major changes and for legacy systems	RQ-13	ICT risk owner	Yes	Partly ready	Partly ready	Head of Information Security				30 Sep 2026	GAP-02	No risk assessment in the last 12 months for the legacy reporting server	OK
EV-10	ICT risk management	RM-05 Protection, detection and resilient systems	The information security policy and the access, authentication, change and patch policies	RQ-14	ICT risk owner	Yes	Ready	Ready	Head of Information Security				30 Sep 2026			OK
EV-11	ICT risk management	RM-05 Protection, detection and resilient systems	The description of the detection mechanisms, alert thresholds and their tests	RQ-15	ICT risk owner	Yes	Ready	Ready	Head of Information Security				30 Sep 2026			OK
EV-12	ICT risk management	RM-06 Continuity, backup and recovery planned and tested	The ICT business continuity policy, business impact analysis and response and recovery plans	RQ-16, RQ-24	ICT risk owner	Yes	Ready	Ready	Head of Information Security				30 Sep 2026			OK
EV-13	ICT risk management	RM-06 Continuity, backup and recovery planned and tested	Backup policy, restoration procedures and the recovery objectives of each critical or important function	RQ-19	ICT risk owner	Yes	Ready	Ready	Head of Information Security				30 Sep 2026			OK
EV-14	ICT risk management	RM-06 Continuity, backup and recovery planned and tested	Test records for the continuity, response and recovery plans, with the report of deficiencies to the management body	RQ-17, RQ-24	ICT risk owner	Yes	Partly ready	Partly ready	Head of Information Security				30 Sep 2026	GAP-03	The test of the continuity, response and recovery plans for all functions is overdue	OK
EV-15	ICT risk management	RM-07 Learning, training and crisis communication	Post-incident review records and the changes they led to	RQ-20	ICT risk owner	Yes	Ready	Ready	Head of Information Security				30 Sep 2026			OK
EV-16	ICT risk management	RM-07 Learning, training and crisis communication	Awareness and digital operational resilience training records	RQ-21	ICT risk owner	Yes	Ready	Ready	Head of Information Security				30 Sep 2026			OK
EV-17	ICT risk management	RM-07 Learning, training and crisis communication	The crisis communication plan and the name of the person tasked	RQ-22	ICT risk owner	Yes	Ready	Ready	Head of Information Security				30 Sep 2026			OK
EV-18	ICT-related incident management, classification and reporting	IM-01 Incidents managed, logged and classified	The incident management procedure and the incident log	RQ-27	Incident manager	Yes	Ready	Ready	Information Security Manager				30 Sep 2026			OK
EV-19	ICT-related incident management, classification and reporting	IM-01 Incidents managed, logged and classified	A classification record for each incident	RQ-28	Incident manager	Yes	Ready	Ready	Information Security Manager				30 Sep 2026			OK
EV-20	ICT-related incident management, classification and reporting	IM-02 Major incidents can be reported on time	The reporting log, with a copy of every report and its time (P18)	RQ-29, RQ-31	Incident manager	Yes	Partly ready	Partly ready	Information Security Manager				30 Sep 2026	GAP-04	Access to the authority's channel not tested in the last 12 months	OK
EV-21	Digital operational resilience testing	RT-01 A risk-based resilience testing programme	The approved testing programme	RQ-32, RQ-34, RQ-35, RQ-36, RQ-40	Resilience testing lead	Yes	Ready	Ready	Security Assurance Lead				30 Sep 2026			OK
EV-22	Digital operational resilience testing	RT-01 A risk-based resilience testing programme	The register of test findings with priority, owner, due date and validated closure	RQ-32	Resilience testing lead	Yes	Ready	Ready	Security Assurance Lead				30 Sep 2026			OK
EV-23	Digital operational resilience testing	RT-02 Systems behind critical or important functions tested every 12 months	Test records for each system behind a critical or important function	RQ-33	Resilience testing lead	Yes	Partly ready	Partly ready	Security Assurance Lead				30 Sep 2026	GAP-05	Four of five systems have a counting test in the last 12 months	OK
EV-24	Digital operational resilience testing	RT-03 Threat-led penetration testing, if the entity is identified	The TLPT identification, validated scope, summary report, remediation plans and attestation	RQ-37, RQ-38, RQ-39	Resilience testing lead	No		Not applicable	Security Assurance Lead				30 Sep 2026			Not for your profile
EV-25	Management of ICT third-party risk	TP-01 The register of information is complete and valid	The register of information and the acknowledgement of the latest submission	RQ-42, RQ-43	Third-party arrangements owner	Yes	Partly ready	Partly ready	Head of Procurement	Register of information submitted on 27 Mar 2026	27 Mar 2026	27 Mar 2029	30 Sep 2026	GAP-06	One register finding: the hosting subcontractor has no LEI or EUID	OK
EV-26	Management of ICT third-party risk	TP-02 Third-party strategy, policy and monitoring role	The ICT third-party strategy and the policy on critical or important services, with the management body's approval	RQ-44	Management body	Yes	Ready	Ready	The board	Strategy and policy approved by the board on 10 Jun 2026	10 Jun 2026	10 Jun 2029	30 Sep 2026			OK
EV-27	Management of ICT third-party risk	TP-02 Third-party strategy, policy and monitoring role	The designation of the monitoring role or senior manager	RQ-45	Management body	Yes	Ready	Ready	The board				30 Sep 2026			OK
EV-28	Management of ICT third-party risk	TP-03 Assessment before contracting, audit and concentration	Pre-contract assessments, due diligence and concentration checks for critical or important arrangements	RQ-46	Third-party arrangements owner	Yes	Ready	Ready	Head of Procurement				30 Sep 2026			OK
EV-29	Management of ICT third-party risk	TP-03 Assessment before contracting, audit and concentration	The check of each provider against the ESAs' list of critical providers	RQ-51	Third-party arrangements owner	Yes	Ready	Ready	Head of Procurement				30 Sep 2026			OK
EV-30	Management of ICT third-party risk	TP-04 Contract terms in place	The contracts, checked against the Article 30 terms	RQ-47, RQ-48	Legal	Yes	Partly ready	Partly ready	General Counsel				30 Sep 2026	GAP-07	CA-001 lacks the Article 30(3) audit, access and TLPT terms	OK
EV-31	Management of ICT third-party risk	TP-05 Exit plans and subcontracting for critical or important arrangements	Exit plans for critical or important arrangements, with review and test records	RQ-49	Third-party arrangements owner	Yes	Not ready	Not ready	Head of Procurement				30 Sep 2026	GAP-08	No exit plan for CA-001	OK
EV-32	Management of ICT third-party risk	TP-05 Exit plans and subcontracting for critical or important arrangements	Subcontracting assessments and the record of notified changes	RQ-50	Third-party arrangements owner	Yes	Ready	Ready	Head of Procurement				30 Sep 2026			OK
EV-33	Management of ICT third-party risk	TP-01 The register of information is complete and valid	The record of each planned critical or important arrangement and when the authority was told	RQ-43	Third-party arrangements owner	Yes	Ready	Ready	Head of Procurement				30 Sep 2026			OK
EV-34	Information sharing	IS-01 Information sharing and threat notification: a decision	The decision on information sharing and threat notification, and any notice to the authority	RQ-52, RQ-30	ICT risk owner	Yes	Ready	Ready	Head of Information Security				30 Sep 2026			OK

Sign-off

Role	Name	Date	Signature or reference
Checked (DORA programme lead)	Head of Compliance	[[YYYY-MM-DD]]	[[Reference]]
Accepted (Management body)	The board	[[YYYY-MM-DD]]	[[Reference]]
Next check due	[[With the next readiness self-assessment, within 6 months (DR-18)]]	[[YYYY-MM-DD]]	[[Reference]]

What the check found. 25 of 33 ready; 7 partly ready; 1 not ready; 1 not applicable. EV-24 does not apply: A TLPT authority has not identified the entity (DR-16).

The records not fully ready are EV-03, EV-09, EV-14, EV-20, EV-23, EV-25, EV-30, EV-31. Each has a note and a gap in the DORA Gap & Remediation Tracker: GAP-01, GAP-02, GAP-03, GAP-04, GAP-05, GAP-06, GAP-07, GAP-08. Readiness item SV-01 is therefore Operating: 25 of 33 evidence items ready; the 8 not fully ready are each behind a gap in the tracker.

A record can be Ready while its readiness item still has an open gap. The checklist asks whether a supervisor could be handed the record. The DORA Readiness Self-Assessment asks whether the whole duty works.

Keep until. The facts give the date of six records: the scope assessment, the framework, its review report, the strategy, the register submission and the third-party policy. Their keep-until dates show the rule at work, with the pack's default of 3 years. Enter the date of each record in the same way.

Records Explained

What each record is, which requirement asks for it and what to show

Each row is one record a supervisor can ask for. The DORA Article-to-Control Mapping Library gives the text of each requirement and what an entity must be able to show. The documents listed here help with the work. Using one does not by itself show that a requirement is met.

The 34 records

Item	Record	Requirements that ask for it	Who the duty falls on	CISO Times documents that help
EV-01	The scope and proportionality assessment, approved by the management body	RQ-01 Know whether DORA binds you (Article 2(1), (3), (4)) RQ-02 Apply the rules in proportion (Article 4)	Every financial entity in scope	None yet
EV-02	Minutes of the management body's approvals and its reports	RQ-04 The management body owns ICT risk (Article 5(1), (2)) RQ-05 Reporting channels to the management body (Article 5(2)(i)) RQ-26 Governance under the simplified framework (Delegated Regulation 2024/1774 Article 28)	Entities under the full framework (not the Article 16 entities); or Entities under the simplified framework (Article 16)	P11-A07 Executive Committee Security Report Deck P11-A08 Key Risk Indicator Threshold & Escalation Model P19-A03 Internal Security Assessment Procedure P19-A07 Maturity Assessment Report Template P19-A09 Maturity Results Executive Summary Deck P20-A09 Annual Control Testing Plan P20-A10 Control Assurance Dashboard P22-A02 Business Continuity & ICT Resilience Policy P22-A09 Resilience Readiness Dashboard P03-A03 Board Cybersecurity Report Deck Template P04-A02 Policy Framework Standard P05-A02 Risk Assessment Methodology & Scoring Model P05-A04 Cyber Risk Appetite Statement Template P05-A05 Information Security Risk Register
EV-03	The management body's training record	RQ-06 Members keep their ICT knowledge current (Article 5(4))	Entities under the full framework (not the Article 16 entities)	P03-A03 Board Cybersecurity Report Deck Template P04-A02 Policy Framework Standard P05-A02 Risk Assessment Methodology & Scoring Model P05-A04 Cyber Risk Appetite Statement Template P05-A05 Information Security Risk Register P16-A03 Role-Based Security Training Matrix
EV-04	The ICT risk management framework document	RQ-03 Run the simplified framework (Article 16(1)(a) to (d); Delegated Regulation 2024/1774 Articles 29 to 38) RQ-07 A documented ICT risk management framework (Article 6(1) to (3))	Entities under the simplified framework (Article 16); or Entities under the full framework (not the Article 16 entities)	P22-A02 Business Continuity & ICT Resilience Policy P19-A05 Assessment Evidence Request Checklist P20-A03 Control Inventory & Ownership Register P20-A06 Control Test Workpaper Template P20-A07 Control Evidence Standards Checklist
EV-05	The latest report on the review of the framework, in a searchable electronic format	RQ-09 Review the framework every year and report on it (Article 6(5)) RQ-25 Lessons, training and the review report (Article 16(1)(h), 16(2); Delegated Regulation 2024/1774 Article 41)	Entities under the full framework (not the Article 16 entities); or Entities under the simplified framework (Article 16)	P19-A02 Security Maturity Model & Scoring Method P19-A04 Security Programme Maturity Assessment P19-A06 Maturity Findings & Improvement Tracker P19-A07 Maturity Assessment Report Template P19-A08 Target-State Maturity Roadmap P20-A02 Control Testing Methodology P20-A03 Control Inventory & Ownership Register P20-A04 Unified Control Framework Mapping Workbook P20-A10 Control Assurance Dashboard P19-A03 Internal Security Assessment Procedure P20-A05 Control Test Execution Procedure P20-A06 Control Test Workpaper Template
EV-06	The digital operational resilience strategy	RQ-10 A digital operational resilience strategy (Article 6(8))	Entities under the full framework (not the Article 16 entities)	P11-A02 Security Metric Definition & Measurement Method P11-A03 Security KPI & KRI Catalogue P11-A04 Metric Definition Card Template P11-A08 Key Risk Indicator Threshold & Escalation Model P19-A08 Target-State Maturity Roadmap
EV-07	The ICT audit plan, audit reports and follow-up of critical findings	RQ-08 Control function, three lines and ICT audit (Article 6(4), (6), (7))	Entities under the full framework, other than microenterprises	P19-A02 Security Maturity Model & Scoring Method P19-A03 Internal Security Assessment Procedure P19-A06 Maturity Findings & Improvement Tracker P19-A07 Maturity Assessment Report Template P20-A02 Control Testing Methodology P20-A05 Control Test Execution Procedure P20-A08 Control Deficiency & Remediation Tracker P20-A09 Annual Control Testing Plan
EV-08	Inventories of functions, information assets, ICT assets and ICT third-party dependencies	RQ-12 Know your functions, assets and dependencies (Article 8(1), (2), (4) to (6)) RQ-23 Key dependencies and critical functions (Article 16(1)(e); Delegated Regulation 2024/1774 Article 30)	Entities under the full framework (not the Article 16 entities); or Entities under the simplified framework (Article 16)	P15-A02 Information Classification & Handling Policy P15-A04 Classification & Labelling Procedure P15-A05 Information Asset Register P15-A06 Information Asset Classification Workbook P15-A09 Information Ownership Responsibility Matrix P03-A03 Board Cybersecurity Report Deck Template P04-A02 Policy Framework Standard P05-A02 Risk Assessment Methodology & Scoring Model P05-A04 Cyber Risk Appetite Statement Template P05-A05 Information Security Risk Register P22-A07 Resilience Dependency Register
EV-09	ICT risk assessments for major changes and for legacy systems	RQ-13 Risk assessments on change and on legacy systems (Article 8(3), (7))	Entities under the full framework, other than microenterprises	P03-A03 Board Cybersecurity Report Deck Template P04-A02 Policy Framework Standard P05-A02 Risk Assessment Methodology & Scoring Model P05-A04 Cyber Risk Appetite Statement Template P05-A05 Information Security Risk Register P17-A07 End-of-Life Software & Unsupported System Register
EV-10	The information security policy and the access, authentication, change and patch policies	RQ-14 Protection and prevention (Article 9)	Entities under the full framework (not the Article 16 entities)	P13-A02 Access Control Policy P13-A03 Joiner-Mover-Leaver Operating Procedure P13-A04 Role-Based Access Profile Matrix P13-A09 Leaver Timeliness & Orphaned Account Report P14-A02 Privileged Access Standard P14-A03 Privileged Access Request, Elevation & Revocation Procedure P14-A04 Privileged & Service Account Inventory P14-A06 Privileged Access Control Review Workbook P14-A07 Privileged Session Review Record P14-A09 Privileged Access Metrics Dashboard P15-A02 Information Classification & Handling Policy P15-A03 Classification Level Handling Rules Matrix P17-A02 Patch Management Standard P17-A03 Monthly Patch Cycle Operating Procedure P17-A04 Patch Deployment Ring & Maintenance Window Plan P17-A05 Emergency Out-of-Band Patching Procedure P17-A06 Patch Deployment Verification Checklist P17-A08 Patch Compliance Dashboard P17-A09 Patch Deferral Request Form
EV-11	The description of the detection mechanisms, alert thresholds and their tests	RQ-15 Detection (Article 10)	Entities under the full framework (not the Article 16 entities)	P03-A03 Board Cybersecurity Report Deck Template P04-A02 Policy Framework Standard P05-A02 Risk Assessment Methodology & Scoring Model P05-A04 Cyber Risk Appetite Statement Template P05-A05 Information Security Risk Register
EV-12	The ICT business continuity policy, business impact analysis and response and recovery plans	RQ-16 Continuity policy, response and recovery plans (Article 11(1) to (5), (8)) RQ-24 Continuity, backup and restoration, and their tests (Article 16(1)(f), (g); Delegated Regulation 2024/1774 Articles 39 and 40)	Entities under the full framework (not the Article 16 entities); or Entities under the simplified framework (Article 16)	P22-A02 Business Continuity & ICT Resilience Policy P22-A03 Cyber Recovery Operating Procedure P22-A04 Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) P22-A05 Cyber Recovery Plan Template P22-A07 Resilience Dependency Register P23-A02 Restore Testing Methodology P19-A03 Internal Security Assessment Procedure P20-A02 Control Testing Methodology P20-A04 Unified Control Framework Mapping Workbook P20-A05 Control Test Execution Procedure P20-A06 Control Test Workpaper Template P22-A09 Resilience Readiness Dashboard P23-A05 Restore Test Workbook P23-A07 Backup Failure & Restore Findings Tracker P23-A08 Restore Test Evidence Report Template P23-A09 Backup Assurance Dashboard
EV-13	Backup policy, restoration procedures and the recovery objectives of each critical or important function	RQ-19 Backup, restoration and recovery (Article 12)	Entities under the full framework (not the Article 16 entities)	P22-A02 Business Continuity & ICT Resilience Policy P22-A03 Cyber Recovery Operating Procedure P22-A04 Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) P22-A05 Cyber Recovery Plan Template P22-A06 Clean-Room Recovery & Rebuild Checklist P23-A02 Restore Testing Methodology P23-A03 Backup Operations & Restore Test Procedure P23-A04 Backup Coverage & Retention Matrix P23-A05 Restore Test Workbook P23-A06 Immutable & Offline Backup Protection Checklist P23-A07 Backup Failure & Restore Findings Tracker P23-A08 Restore Test Evidence Report Template P23-A09 Backup Assurance Dashboard
EV-14	Test records for the continuity, response and recovery plans, with the report of deficiencies to the management body	RQ-17 Test the plans at least yearly (Article 11(6)) RQ-24 Continuity, backup and restoration, and their tests (Article 16(1)(f), (g); Delegated Regulation 2024/1774 Articles 39 and 40)	Entities under the full framework (not the Article 16 entities); or Entities under the simplified framework (Article 16)	P10-A02 Tabletop Exercise Design Methodology P10-A03 Exercise Planning & Facilitation Procedure P10-A04 Tabletop Scenario — Ransomware Encryption of Core Systems P10-A05 Tabletop Scenario — Critical Supplier Outage P10-A08 Tabletop Scenario — Executive Payment Fraud P10-A10 Exercise Logistics & Participant Readiness Checklist P10-A11 Exercise Observations & Improvement Tracker P10-A12 Exercise After-Action Report Template P22-A02 Business Continuity & ICT Resilience Policy P22-A05 Cyber Recovery Plan Template P22-A09 Resilience Readiness Dashboard P23-A02 Restore Testing Methodology P19-A03 Internal Security Assessment Procedure P20-A02 Control Testing Methodology P20-A04 Unified Control Framework Mapping Workbook P20-A05 Control Test Execution Procedure P20-A06 Control Test Workpaper Template P23-A05 Restore Test Workbook P23-A07 Backup Failure & Restore Findings Tracker P23-A08 Restore Test Evidence Report Template P23-A09 Backup Assurance Dashboard
EV-15	Post-incident review records and the changes they led to	RQ-20 Learn from incidents and tests (Article 13(1) to (3), (5))	Entities under the full framework (not the Article 16 entities)	P03-A03 Board Cybersecurity Report Deck Template P04-A02 Policy Framework Standard P05-A02 Risk Assessment Methodology & Scoring Model P05-A04 Cyber Risk Appetite Statement Template P05-A05 Information Security Risk Register P11-A07 Executive Committee Security Report Deck P11-A08 Key Risk Indicator Threshold & Escalation Model
EV-16	Awareness and digital operational resilience training records	RQ-21 Awareness and resilience training for all staff (Article 13(6))	Entities under the full framework (not the Article 16 entities)	P16-A02 Annual Security Awareness Plan P16-A03 Role-Based Security Training Matrix P16-A06 New Joiner Security Induction Deck P16-A07 Training Completion & Evidence Register P16-A09 Human Risk Metrics Dashboard
EV-17	The crisis communication plan and the name of the person tasked	RQ-22 Crisis communication (Article 14)	Entities under the full framework (not the Article 16 entities)	P03-A03 Board Cybersecurity Report Deck Template P04-A02 Policy Framework Standard P05-A02 Risk Assessment Methodology & Scoring Model P05-A04 Cyber Risk Appetite Statement Template P05-A05 Information Security Risk Register P22-A08 Crisis & Recovery Responsibility Matrix
EV-18	The incident management procedure and the incident log	RQ-27 An incident management process (Article 17)	Every financial entity in scope	P09-A02 Security Incident Management Policy P09-A03 Incident Response Plan P09-A04 Incident Classification, Severity & Escalation Matrix P09-A09 Incident Case & Action Log P09-A11 Post-Incident Review Template P18-A07 Regulatory Notification Log
EV-19	A classification record for each incident	RQ-28 Classify incidents by the criteria (Article 18; Delegated Regulation 2024/1772)	Every financial entity in scope	P09-A02 Security Incident Management Policy P09-A03 Incident Response Plan P09-A04 Incident Classification, Severity & Escalation Matrix P09-A09 Incident Case & Action Log P09-A11 Post-Incident Review Template P18-A03 Reportability Decision Model
EV-20	The reporting log, with a copy of every report and its time (P18)	RQ-29 Report major incidents on time (Article 19(1), (3), (4)) RQ-31 Payment-related incidents (Article 23)	Every financial entity in scope	P18-A02 EU Incident Notification Timeline Matrix (NIS2, DORA, GDPR) P18-A04 Regulatory Notification Operating Procedure P18-A07 Regulatory Notification Log P18-A08 Notification Readiness Checklist P09-A02 Security Incident Management Policy P09-A03 Incident Response Plan P09-A04 Incident Classification, Severity & Escalation Matrix P09-A09 Incident Case & Action Log P09-A11 Post-Incident Review Template
EV-21	The approved testing programme	RQ-32 A resilience testing programme (Article 24(1) to (5)) RQ-34 A range of tests (Article 25(1)) RQ-35 Microenterprises: risk-based testing (Article 25(3)) RQ-36 Vulnerability assessments before deployment (Article 25(2)) RQ-40 ICT security testing under the simplified framework (Article 16(1)(g); Delegated Regulation 2024/1774 Article 36)	Every financial entity in scope other than microenterprises; or Every financial entity in scope; or Microenterprises; or Entities under the simplified framework (Article 16)	P10-A02 Tabletop Exercise Design Methodology P10-A11 Exercise Observations & Improvement Tracker P10-A12 Exercise After-Action Report Template P01-A02 Vulnerability & Exposure Management Standard P01-A03 Vulnerability Triage & Remediation Operating Procedure P20-A09 Annual Control Testing Plan P19-A03 Internal Security Assessment Procedure P20-A02 Control Testing Methodology P20-A04 Unified Control Framework Mapping Workbook P20-A05 Control Test Execution Procedure P20-A06 Control Test Workpaper Template
EV-22	The register of test findings with priority, owner, due date and validated closure	RQ-32 A resilience testing programme (Article 24(1) to (5))	Every financial entity in scope other than microenterprises	P10-A02 Tabletop Exercise Design Methodology P10-A11 Exercise Observations & Improvement Tracker P10-A12 Exercise After-Action Report Template
EV-23	Test records for each system behind a critical or important function	RQ-33 Test the systems behind critical functions every year (Article 24(6))	Every financial entity in scope other than microenterprises	P01-A02 Vulnerability & Exposure Management Standard P01-A03 Vulnerability Triage & Remediation Operating Procedure P10-A02 Tabletop Exercise Design Methodology P20-A09 Annual Control Testing Plan
EV-24	The TLPT identification, validated scope, summary report, remediation plans and attestation	RQ-37 Threat-led penetration testing (if identified) (Article 26(1) to (3), (8)) RQ-38 TLPT closure, remediation and attestation (Article 26(6), (7); Delegated Regulation 2025/1190 Articles 12 and 13) RQ-39 Testers for TLPT (Article 27)	Entities that a TLPT authority has identified	P01-A02 Vulnerability & Exposure Management Standard P01-A03 Vulnerability Triage & Remediation Operating Procedure P10-A02 Tabletop Exercise Design Methodology P20-A09 Annual Control Testing Plan
EV-25	The register of information and the acknowledgement of the latest submission	RQ-42 The register of information (Article 28(3); Implementing Regulation 2024/2956) RQ-43 Report on the register and tell the authority first (Article 28(3), third to fifth subparagraphs)	Every financial entity in scope	P06-A02 Third-Party Security Policy P06-A03 Supplier Security Assessment Procedure P06-A04 Supplier Criticality & Tiering Model P06-A07 Supplier Contract Security Clause Library P06-A08 Supplier Security Risk Register
EV-26	The ICT third-party strategy and the policy on critical or important services, with the management body's approval	RQ-44 A third-party risk strategy and a policy (Article 28(2); Delegated Regulation 2024/1773)	Entities under the full framework, other than microenterprises	P06-A02 Third-Party Security Policy P06-A03 Supplier Security Assessment Procedure P06-A04 Supplier Criticality & Tiering Model P06-A07 Supplier Contract Security Clause Library P06-A08 Supplier Security Risk Register
EV-27	The designation of the monitoring role or senior manager	RQ-45 A role to monitor the arrangements (Article 5(3))	Entities under the full framework, other than microenterprises	P06-A02 Third-Party Security Policy P06-A03 Supplier Security Assessment Procedure P06-A04 Supplier Criticality & Tiering Model P06-A07 Supplier Contract Security Clause Library P06-A08 Supplier Security Risk Register
EV-28	Pre-contract assessments, due diligence and concentration checks for critical or important arrangements	RQ-46 Assess before you contract, then audit (Article 28(4) to (6); Article 29(1))	Every financial entity in scope	P06-A02 Third-Party Security Policy P06-A03 Supplier Security Assessment Procedure P06-A04 Supplier Criticality & Tiering Model P06-A07 Supplier Contract Security Clause Library P06-A08 Supplier Security Risk Register P26-A09 Standard Security Commitments Schedule
EV-29	The check of each provider against the ESAs' list of critical providers	RQ-51 Know whether a provider is designated as critical (Articles 31 and 28(3))	Every financial entity in scope	P06-A02 Third-Party Security Policy P06-A03 Supplier Security Assessment Procedure P06-A04 Supplier Criticality & Tiering Model P06-A07 Supplier Contract Security Clause Library P06-A08 Supplier Security Risk Register
EV-30	The contracts, checked against the Article 30 terms	RQ-47 Contract terms for every arrangement (Article 30(1), (2)) RQ-48 More terms for critical or important functions (Article 30(3))	Every financial entity in scope	P06-A02 Third-Party Security Policy P06-A03 Supplier Security Assessment Procedure P06-A04 Supplier Criticality & Tiering Model P06-A07 Supplier Contract Security Clause Library P06-A08 Supplier Security Risk Register P26-A02 Questionnaire Response Governance Method P26-A06 Response Quality & Over-Commitment Checklist P26-A09 Standard Security Commitments Schedule P10-A05 Tabletop Scenario — Critical Supplier Outage P26-A05 Evidence & Attestation Library Index
EV-31	Exit plans for critical or important arrangements, with review and test records	RQ-49 Exit plans and the right to end the contract (Article 28(7), (8))	Every financial entity in scope	P06-A02 Third-Party Security Policy P06-A03 Supplier Security Assessment Procedure P06-A04 Supplier Criticality & Tiering Model P06-A07 Supplier Contract Security Clause Library P06-A08 Supplier Security Risk Register
EV-32	Subcontracting assessments and the record of notified changes	RQ-50 Subcontracting of critical or important services (Article 29(2); Delegated Regulation 2025/532)	Every financial entity in scope	P06-A02 Third-Party Security Policy P06-A03 Supplier Security Assessment Procedure P06-A04 Supplier Criticality & Tiering Model P06-A07 Supplier Contract Security Clause Library P06-A08 Supplier Security Risk Register
EV-33	The record of each planned critical or important arrangement and when the authority was told	RQ-43 Report on the register and tell the authority first (Article 28(3), third to fifth subparagraphs)	Every financial entity in scope	P06-A02 Third-Party Security Policy P06-A03 Supplier Security Assessment Procedure P06-A04 Supplier Criticality & Tiering Model P06-A07 Supplier Contract Security Clause Library P06-A08 Supplier Security Risk Register
EV-34	The decision on information sharing and threat notification, and any notice to the authority	RQ-52 Information sharing (optional) (Article 45) RQ-30 Significant cyber threats (optional) (Article 19(2))	Every financial entity in scope	P09-A02 Security Incident Management Policy P09-A03 Incident Response Plan P09-A04 Incident Classification, Severity & Escalation Matrix P09-A09 Incident Case & Action Log P09-A11 Post-Incident Review Template P18-A02 EU Incident Notification Timeline Matrix (NIS2, DORA, GDPR) P18-A03 Reportability Decision Model

Where another pack owns the content

Items	What to know
EV-18 to EV-20	P09 owns incident response and every decision right, clock and recovery criterion. P18 holds the DORA classification test and the reporting duties. This checklist asks only whether the records exist (DR-15). It states no reporting clock.
EV-13, EV-14	Recovery objectives, and the recovery test, are P22's (P22 RR-14). The restore test is P23's (P23 BR-13). Cite them by ID. An exercise or tabletop under P10 is an exercise, not a test of a system, and is never counted as one (DR-13).
EV-21 to EV-24	Test records count only when the test was held, independent and dated within the period (DR-12, DR-14). TLPT applies only after a TLPT authority has identified the entity (DR-16).
EV-25, EV-33	The register of information comes first among the third-party tasks and shows no open data finding before it is submitted (DR-08). The yearly report and the dates and format are your authority's (DR-21).

Who It Binds

Which records each kind of entity owes

Worked out from the facts that decide it: whether the entity follows the full framework (Articles 5 to 15) or the simplified one (Article 16), whether it is a microenterprise, and whether a TLPT authority has identified it. The entity type changes no record on this checklist. Read DORA Proportionality & Scope Assessment to decide which column is yours.

Records by kind of entity

Item	Record	Full framework	Full framework, microenterprise	Full framework, identified for TLPT	Simplified framework (Article 16)	Simplified framework, microenterprise
EV-01	The scope and proportionality assessment, approved by the management body	Yes	Yes	Yes	Yes	Yes
EV-02	Minutes of the management body's approvals and its reports	Yes	Yes	Yes	Yes	Yes
EV-03	The management body's training record	Yes	Yes	Yes	No	No
EV-04	The ICT risk management framework document	Yes	Yes	Yes	Yes	Yes
EV-05	The latest report on the review of the framework, in a searchable electronic format	Yes	Yes	Yes	Yes	Yes
EV-06	The digital operational resilience strategy	Yes	Yes	Yes	No	No
EV-07	The ICT audit plan, audit reports and follow-up of critical findings	Yes	No	Yes	No	No
EV-08	Inventories of functions, information assets, ICT assets and ICT third-party dependencies	Yes	Yes	Yes	Yes	Yes
EV-09	ICT risk assessments for major changes and for legacy systems	Yes	No	Yes	No	No
EV-10	The information security policy and the access, authentication, change and patch policies	Yes	Yes	Yes	No	No
EV-11	The description of the detection mechanisms, alert thresholds and their tests	Yes	Yes	Yes	No	No
EV-12	The ICT business continuity policy, business impact analysis and response and recovery plans	Yes	Yes	Yes	Yes	Yes
EV-13	Backup policy, restoration procedures and the recovery objectives of each critical or important function	Yes	Yes	Yes	No	No
EV-14	Test records for the continuity, response and recovery plans, with the report of deficiencies to the management body	Yes	Yes	Yes	Yes	Yes
EV-15	Post-incident review records and the changes they led to	Yes	Yes	Yes	No	No
EV-16	Awareness and digital operational resilience training records	Yes	Yes	Yes	No	No
EV-17	The crisis communication plan and the name of the person tasked	Yes	Yes	Yes	No	No
EV-18	The incident management procedure and the incident log	Yes	Yes	Yes	Yes	Yes
EV-19	A classification record for each incident	Yes	Yes	Yes	Yes	Yes
EV-20	The reporting log, with a copy of every report and its time (P18)	Yes	Yes	Yes	Yes	Yes
EV-21	The approved testing programme	Yes	Yes	Yes	Yes	Yes
EV-22	The register of test findings with priority, owner, due date and validated closure	Yes	No	Yes	Yes	No
EV-23	Test records for each system behind a critical or important function	Yes	No	Yes	Yes	No
EV-24	The TLPT identification, validated scope, summary report, remediation plans and attestation	No	No	Yes	No	No
EV-25	The register of information and the acknowledgement of the latest submission	Yes	Yes	Yes	Yes	Yes
EV-26	The ICT third-party strategy and the policy on critical or important services, with the management body's approval	Yes	No	Yes	No	No
EV-27	The designation of the monitoring role or senior manager	Yes	No	Yes	No	No
EV-28	Pre-contract assessments, due diligence and concentration checks for critical or important arrangements	Yes	Yes	Yes	Yes	Yes
EV-29	The check of each provider against the ESAs' list of critical providers	Yes	Yes	Yes	Yes	Yes
EV-30	The contracts, checked against the Article 30 terms	Yes	Yes	Yes	Yes	Yes
EV-31	Exit plans for critical or important arrangements, with review and test records	Yes	Yes	Yes	Yes	Yes
EV-32	Subcontracting assessments and the record of notified changes	Yes	Yes	Yes	Yes	Yes
EV-33	The record of each planned critical or important arrangement and when the authority was told	Yes	Yes	Yes	Yes	Yes
EV-34	The decision on information sharing and threat notification, and any notice to the authority	Yes	Yes	Yes	Yes	Yes
Records that apply		33 of 34	27 of 34	34 of 34	21 of 34	19 of 34

Outside DORA. An entity that is excluded by Article 2(3), or is not a financial entity, owes none of these records. On the Checklist sheet, choose that framework and every record reads Not applicable.

The column is a reading of the Regulation's text for a profile, not legal advice. This document helps you see what DORA asks of an entity like yours and what you can show. It is not legal advice, and following it is not a statement that you comply with DORA or any standard. Whether DORA binds you, and which of its duties apply to you, depends on what you are, how you are authorised and how your Member State and your supervisor apply it: confirm it with counsel or your competent authority.

Regulation (EU) 2022/2554 binds the financial entities of its Article 2(1), points (a) to (t), except those Article 2(3) excludes and any that a Member State excludes under Article 2(4). Articles 5 to 15 do not apply to the entities of its Article 16(1), which follow Article 16 and Title III of Delegated Regulation (EU) 2024/1774. Several duties do not apply to microenterprises, and the Regulation says where. It reaches an ICT third-party service provider through the contract with a financial entity and, for a provider designated as critical, through the oversight framework of Chapter V, Section II.

If you supply ICT services to a financial entity

DORA lists ICT third-party service providers in Article 2(1), point (u), and defines financial entities as points (a) to (t) only. Its duties for the contract fall on the financial entity. A supplier is reached by DORA mainly through the terms its customers must ask for (the supplier flow-down list) and the information they must collect. A supplier designated as critical is also overseen by a Lead Overseer. A supplier does not complete this checklist or the readiness assessment (DR-22). Check your contracts and the information you give against these terms, which a financial entity must ask for.

Term	What your customer must ask for
FD-01	A written contract that describes the services and says whether, and on what terms, subcontracting is allowed; names the locations of the services and of the data, and gives advance notice of a change
FD-02	Terms on the availability, authenticity, integrity and confidentiality of data, and on access to and return of the entity's data in an accessible format on the provider's insolvency or the end of the contract
FD-03	Service levels, and assistance in an incident at no extra cost or at a cost agreed in advance
FD-04	Full cooperation with the entity's competent and resolution authorities; termination rights and notice periods; taking part in the entity's awareness and resilience training
FD-05	For a service supporting a critical or important function: full service levels with precise targets, notice and reporting duties, contingency plans and security measures that the provider implements and tests, and taking part in the entity's TLPT
FD-06	Unrestricted rights of access, inspection and audit for the entity and the authorities, and cooperation during on-site inspections
FD-07	An exit strategy with a mandatory adequate transition period
FD-08	Subcontracting conditions: responsibility for subcontracted services, monitoring and reporting, the same access and audit rights, and notice of material changes with time for the entity to approve or object
FD-09	The information the entity must enter in its register: the provider's legal name, a valid LEI or EUID, its ultimate parent, the country of its headquarters, and the same identifiers for the subcontractors behind a critical or important service
FD-10	Where the ESAs designate the provider as critical: oversight by a Lead Overseer, a yearly list, and, for a provider established in a third country, a subsidiary in the Union within 12 months

Retention

How long to keep each record, and how to produce it

DORA sets no general period for keeping these records. The pack's default is 3 years, the period it uses for test records, and 5 working days to produce a record. Both are yours to set. Confirm them with counsel and with your competent authority (DR-19, DR-21).

Rule

Steps

Step	What to do
Set the period	Choose how long you keep the records behind each item, and write it in the Keep records for at least cell at the top of the Checklist sheet. The pack's default is shown there. Confirm it with counsel and with your competent authority, because a duty or the authority may require longer (DR-19).
Enter the date of the record	For each item, enter the date of the record you point to: the day it was approved, signed, held or last replaced. The sheet adds the period and shows the keep-until date.
Keep the superseded versions	When you replace a record, such as a policy or a plan, the old version starts its own period from the day it was replaced. Keep it in the same place, marked as superseded, so that you can show what applied on a given day.
Keep the evidence, not only the document	Keep the records that show an item operating, such as minutes, test results, logs and acknowledgements. A policy without them shows that the policy exists, and no more.
Be able to produce it	Name the place where each record is kept in the Record column. Any item must reach the competent authority within the working days shown at the top of the Checklist sheet (DR-19). Test the route each time you repeat the readiness self-assessment, which is at least every six months (DR-18).
Keep it off the main systems	Keep a copy of the checklist and the records it points to where you can reach them during an ICT disruption. A record you cannot reach in an outage cannot be produced in time.
Dispose of records deliberately	After the keep-until date, check that no duty, dispute or request needs the record, then dispose of it under your own records policy. Personal data in a record is also subject to your data protection rules.

Where the period starts: this workbook's defaults

Kind of record	The period starts
A policy, plan, strategy or framework document	The day a newer approved version replaces it. While it is current, it stays.
Minutes, training records, reviews and reports	The date of the record.
Test records and findings	The date of the test, or of the closure of the last finding it raised, whichever is later.
A log or a register that stays live, such as the incident log or the register of information	The date of the latest submission or entry. Keep the earlier submissions.
A contract, or a record about one	The day the contract ends or is replaced. Ask counsel.

These starting points are house defaults. DORA does not set them. Where a duty, a contract or your authority sets another, follow that one.

Lists

EvidenceStatus	EvidenceArea	EntityType	Framework	YesNo
Ready	Scope and proportionality	Credit institution	Full ICT risk management framework (DORA Articles 5 to 15)	Yes
Partly ready	ICT risk management	Payment institution (including an exempted payment institution)	Simplified ICT risk management framework (DORA Article 16)	No
Not ready	ICT-related incident management, classification and reporting	Account information service provider	Out of scope of DORA
	Digital operational resilience testing	Electronic money institution (including an exempted one)	Not a financial entity: a supplier to financial entities
	Management of ICT third-party risk	Investment firm	Not a financial entity, and no financial entity as a customer
	Information sharing	Crypto-asset service provider, or issuer of asset-referenced tokens

Central securities depository

Central counterparty

Trading venue

Trade repository

Manager of alternative investment funds

Management company

Data reporting service provider

Insurance or reinsurance undertaking

Insurance, reinsurance or ancillary insurance intermediary

Institution for occupational retirement provision

Credit rating agency

Administrator of critical benchmarks

Crowdfunding service provider

Securitisation repository

Definitions

Definitions

Term	Meaning in this workbook
Financial entity	An entity of the kinds listed in Article 2(1), points (a) to (t), of DORA, such as a credit institution, a payment institution, an investment firm or an insurance undertaking. ICT third-party service providers are not financial entities. DORA binds financial entities, except those Article 2(3) excludes and those a Member State excludes under Article 2(4).
Microenterprise	A financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, that employs fewer than 10 persons and has an annual turnover or an annual balance sheet total that does not exceed EUR 2 million (DORA Art 3(60)). Several duties do not apply to a microenterprise, and the Regulation says where.
Simplified framework	The lighter ICT risk management framework of DORA Article 16 for small and non-interconnected investment firms, exempted payment institutions, exempted electronic money institutions, certain institutions exempted under Directive 2013/36/EU, and small institutions for occupational retirement provision. Articles 5 to 15 do not apply to them. Title III of Delegated Regulation (EU) 2024/1774 details it.
TLPT	Threat-led penetration testing: a controlled, intelligence-led red team test of the entity's critical live production systems that copies real threat actors (DORA Art 3(17)). Only entities that a TLPT authority identifies perform it, and then at least every 3 years (Art 26).
Profile	The result of the scope assessment for one entity: its regime (the full framework, the simplified framework, out of scope, or supplier), whether it is a microenterprise, whether a TLPT authority has identified it, and the requirements that follow.
Readiness item	One of the readiness items, such as IM-01: a group of requirements that the readiness self-assessment rates in words (Not started, Planned, In place or Operating), never as a score. Each record on this checklist proves one of them.
Record	A document or a log a supervisor can ask for, one row on the Checklist sheet. It is a record when it exists, is current and shows the duty operating.
Ready	The record exists, covers the whole item, is current, and its owner could hand it over in time (DR-19).
Partly ready	The record exists, but part of it is missing or out of date, or some of it would take too long to produce. The Note says what is missing, and the gap is in the tracker.
Not ready	The record does not exist yet. The Note says so, and the gap is in the tracker.
Not applicable	The sheet works this out from your profile. The item belongs to a duty that does not apply to you. You cannot choose it for a duty that does apply (DR-03).
Not assessed	The item applies, and nobody has chosen a status yet. It is counted apart, and in no other total.
Status now	What the sheet counts: Not applicable where the profile says so, otherwise the status you chose, or Not assessed until you choose one.
Keep until	The date of the record plus the years you set in Keep records for at least. The pack's default is 3 years (DR-19).
SV-01	The readiness item "Evidence ready for the competent authority". Operating: every record that applies has an owner, and every record not fully ready is in the gap tracker. In place: a record has no owner, or is not ready and has no gap. Not yet assessed: a record that applies has no status.
Gap tracker	The DORA Gap & Remediation Tracker: every gap with one owner, a priority, a due date and the change that closes it (DR-05, DR-06).
EV-nn	One of EV-01 to EV-34: a record on this checklist.
RQ-nn	A requirement in the DORA Article-to-Control Mapping Library. The Asked for by column lists the ones that ask for a record.
DR-nn	One of the pack's rules, DR-01 onwards, set out in the pack guide and quoted in each document.
DORA programme lead	Keeps the scope assessment, the readiness self-assessment and the gap tracker, and reports to the management body.
ICT risk owner	Owns the ICT risk management framework, the risk assessment and the review report, and the protection and detection controls.
EXAMPLE	An illustration: Lantern Pay Services (EXAMPLE), a small authorised payment institution in an EU Member State, with 64 staff, as at 30 Sep 2026, with the values the pack's other documents hold for it.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 7.5 — Documented information	The whole checklist: documented information created, controlled, kept and ready to produce
NIST CSF 2.0	GV.PO-01 — “Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced”	EV-04, EV-10, EV-12 and EV-26: the policies the entity establishes, communicates and enforces
DORA — Regulation (EU) 2022/2554	Article 4 — financial entities implement the rules of Chapter II in line with proportionality, taking into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations; Chapters III, IV and V, Section I, apply proportionately “as specifically provided for in the relevant rules of those Chapters”; competent authorities consider how the entity applied proportionality when they review its ICT risk management framework on the reports submitted under Articles 6(5) and 16(2)	Who It Binds and the Applies? column: the records follow the duties that apply in proportion to the entity
DORA — Regulation (EU) 2022/2554	Article 5(2) — the management body defines, approves, oversees and is responsible for the ICT risk management framework, bears ultimate responsibility for ICT risk and sets the risk tolerance	EV-02: the management body's approvals and its reports
DORA — Regulation (EU) 2022/2554	Article 6(5) — the ICT risk management framework is documented and reviewed at least once a year (periodically for microenterprises), upon major ICT-related incidents, and following supervisory instructions or conclusions from digital operational resilience testing or audit processes; “It shall be continuously improved on the basis of lessons derived from implementation and monitoring.” A report on the review is submitted to the competent authority on request	EV-05: the review of the framework and the report on it
DORA — Regulation (EU) 2022/2554	Article 6(8) — the framework includes a digital operational resilience strategy that explains how the framework supports the business strategy, sets the risk tolerance level for ICT risk and analyses impact tolerance for ICT disruptions, sets information security objectives with key performance indicators and key risk metrics, explains the ICT reference architecture, outlines the mechanisms that detect incidents and protect against them, evidences the current position on the basis of the major ICT-related incidents reported and the effectiveness of preventive measures, implements resilience testing under Chapter IV, and outlines a communication strategy for incidents that Article 14 requires to be disclosed	EV-06: the digital operational resilience strategy
DORA — Regulation (EU) 2022/2554	Article 11(8) — “Financial entities shall keep readily accessible records of activities before and during disruption events when their ICT business continuity plans and ICT response and recovery plans are activated.”	EV-12 and the Retention sheet: records of activity before and during a disruption, kept readily accessible
DORA — Regulation (EU) 2022/2554	Article 17(2) — record all ICT-related incidents and significant cyber threats, and ensure root causes are identified, documented and addressed	EV-18: the incident log, with root causes
DORA — Regulation (EU) 2022/2554	Article 24(5) — procedures and policies to prioritise, classify and remedy all issues revealed by the tests, and internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed	EV-22: the register of test findings, with validated closure
DORA — Regulation (EU) 2022/2554	Article 28(3) — a register of information on all contractual arrangements for ICT services, distinguishing those supporting critical or important functions	EV-25: the register of information
DORA — Regulation (EU) 2022/2554	Article 28(3), third to fifth subparagraphs — financial entities report at least yearly to the competent authorities on the number of new arrangements, the categories of ICT third-party service providers, the type of contractual arrangements and the ICT services and functions provided; make the full register, or the sections requested, available on request; and inform the competent authority in a timely manner about any planned contractual arrangement on the use of ICT services supporting critical or important functions, and when a function has become critical or important	EV-33: the record of planned critical or important arrangements and when the authority was told
DORA — Regulation (EU) 2022/2554	Article 30(3) — additional contract content for critical or important functions: full service levels, notice duties, contingency plans and security, testing participation, audit and access rights, exit strategies	EV-30: the contracts, checked against the Article 30 terms
DORA — Delegated Regulation (EU) 2024/1774	Article 3 — ICT risk management policies and procedures contain, among other elements, the approved risk tolerance level for ICT risk; a risk assessment procedure and methodology that identifies vulnerabilities and threats and uses quantitative or qualitative indicators of impact and likelihood; the procedure to identify, implement and document risk treatment measures; and, for residual risk, the roles that accept risk above the tolerance level, an inventory of accepted residual risks with justification and a review of them at least once a year	EV-04: the policies and procedures the framework contains
DORA — Delegated Regulation (EU) 2024/1774	Article 27(2) — the report on the review of the ICT risk management framework (DORA Article 6(5)), in a searchable electronic format, contains an introduction and executive summary, the date of the management body’s approval, the reason for the review, the review period, the function responsible, major changes since the previous review, a summary of findings with the severity of weaknesses, deficiencies and gaps, the measures to address them with dates, resources and the function responsible, planned developments, conclusions, information on past reviews and the sources used, including internal audit results (other than for microenterprises), compliance assessments, resilience testing results and external sources	EV-05: the review report, in a searchable electronic format, with the content the Article lists
DORA — Delegated Regulation (EU) 2024/1774	Article 40(3) — the results of the testing are documented, and identified deficiencies “shall be analysed, addressed, and reported to the management body”	EV-14: test results documented, with deficiencies reported to the management body
DORA — Delegated Regulation (EU) 2024/1774	Article 41(2) — the report on the review of the simplified ICT risk management framework, submitted in a searchable electronic format, contains an introduction and executive summary, the date of the management body’s approval where applicable, the reasons for the review, the review period, the person responsible, a summary of findings with a self-assessment of the severity of weaknesses, deficiencies and gaps, the remedying measures with expected dates and the follow-up on earlier gaps, and overall conclusions	EV-05, for an entity under the simplified framework: the review report of the simplified framework
DORA — Implementing Regulation (EU) 2024/2956	Article 3 — the templates of Annexes I to IV are used at entity, sub-consolidated and consolidated level; they cover all ICT services of direct providers and all subcontractors that effectively underpin services supporting critical or important functions or material parts of them; information is accurate, consistent and regularly reviewed, with errors promptly corrected, and meets the data quality principles of accuracy, completeness, consistency, integrity, uniformity and validity; each provider that is a legal person is identified with a valid and active LEI or an EUID (both where available), and subcontractors of services supporting critical or important functions use a valid and active LEI or provide their EUID	EV-25: the templates the register uses, at entity level and above

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Regulation (EU) 2022/2554 (DORA); Delegated Regulations (EU) 2024/1772, 2024/1773, 2024/1774, 2025/301, 2025/532 and 2025/1190; Implementing Regulations (EU) 2024/2956 and 2025/302; as published in the Official Journal and read on 8 October 2026

The Delegated and Implementing Regulations bind the same financial entities as the Regulation they supplement, for the articles each applies to. Title II of Delegated Regulation (EU) 2024/1774 is for the entities that follow Articles 5 to 15; its Title III is for the entities of DORA Article 16(1). Delegated Regulation (EU) 2025/1190 binds only the entities that a TLPT authority identifies.

The competent authority for each financial entity is the one DORA Article 46 names for its type. National law and the authority's own instructions set the dates and channels for the register of information and for reports. None of them is stated here.

This library does not say which ISO/IEC 27001 controls or NIST CSF outcomes meet a DORA requirement. It gives each article's own words, what an entity must be able to show, and the CISO Times documents that help with the work. Where the CISO Times Library holds a mapping between a DORA requirement and a control, it shows it there with how closely the two match and where they differ; confirm it against both texts before relying on it. A document listed here helps with the work a requirement describes. Using it does not by itself show that the requirement is met.

ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. They do not say that meeting one meets any DORA requirement.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.