DORA Gap & Remediation Tracker

Converts DORA gaps into owned, dated actions prioritised by supervisory exposure.

Available soon

Format: Excel
Size: 92 KB
Length: 12 sheets
Version: 1.2
Updated: 8 Oct 2026

Follow this documentFree account. We can email you when it changes.

What's inside

Instructions
Gaps
Readiness Items
Summary
Headline Counts
Priorities
Lists
Definitions
Framework References

What changed

1.214 Oct 2026
The mappings note no longer says the CISO Times Library shows a verification state; it says what a mapping shows and to confirm it against both texts.
1.110 Oct 2026
A financial entity that sells ICT services is also a supplier, and any Priority 1 gap goes to the chair route.
1.08 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Before you start. Complete the DORA Proportionality & Scope Assessment and have the management body approve it (DR-01). DORA binds financial entities only, and what it asks of you depends on what you are. A supplier to a financial entity does not run the readiness assessment (DR-22): see "Adapting this template" below.
2	Set the As-at date, the date of the next management body meeting and the working days for telling its chair on the Summary sheet. The EXAMPLE uses 30 Sep 2026, the date of the first self-assessment. Use today's date, or type =TODAY().
3	On the Readiness Items sheet, set from your profile whether each item applies to you and whether it is a binding duty. Enter the level each item had at your latest DORA Readiness Self-Assessment, and the fact the rating rests on. An item rated Not applicable needs its reason (DR-03). Its Check column shows any item below Operating with no open gap: raise one.
4	Raise one gap on the Gaps sheet for every applicable item below Operating. Give it an ID (GAP-nn), the source "Self-assessment", the item, what is missing as a fact, and the level the item had when you raised the gap. The priority, the supervisory exposure and the evidence items calculate.
5	Enter the change that closes the gap (the document, control, contract term or record it adds or changes), one owner, the effort, and the date raised: the date of the assessment. If a plan already set an earlier date, enter it as the earlier planned date. The due date calculates: the priority's days from the date raised, or the earlier planned date (DR-06).
6	Enter every test finding here too (DR-14), with the source "Test, audit or other finding". Choose its priority from the Priorities sheet. Give it an owner and a due date through the same columns. A person other than the one who fixed the weakness confirms that it is fully addressed before it is Done (Article 24(5)).
7	Keep the status current: Open, agreed, not started. In progress, work started; due date unchanged. Done, the change is made and its record is filed; the item is re-rated at the next assessment. Withdrawn, dropped, with the management body's recorded reason.
8	When a gap is Done, enter the date and where its record is filed, so the evidence checklist can point to it. Do not change the item's level on the Readiness Items sheet until the next self-assessment re-rates it.
9	A blocking gap is entered as Priority 1 on the day it is found and goes to the management body at its next meeting (DR-05: "A blocking gap is a readiness item that is binding on your entity type and is rated below In place. Every blocking gap is entered in the gap tracker as Priority 1 on the day it is found. It goes to the management body at its next meeting. If that meeting is more than [[10]] working days away, the DORA programme lead tells its chair within that time. Any other gap rated Priority 1 follows the same route, whatever its source."). The Summary sheet shows which route applies.
10	Fill the Headline Counts sheet for the report. It counts the readiness items at each level, the blocking gaps and the open and overdue gaps from this workbook. For the measures that other documents hold (register findings, exit plans, systems tested in time, members trained, evidence items ready), enter the count and the total, and name the others. Report counts with the names beside them (DR-04).
11	Repeat the readiness self-assessment at least every 6 months, and whenever the profile, the register or a critical or important contract changes (DR-18). Report the counts to the management body each time.
12	To clear the EXAMPLE, delete the EXAMPLE rows on the Gaps sheet and the EXAMPLE levels and facts on the Readiness Items sheet once your own are entered. The formulas stay. Do not type over the white calculated columns.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

Limitations: This document helps you see what DORA asks of an entity like yours and what you can show. It is not legal advice, and following it is not a statement that you comply with DORA or any standard. Whether DORA binds you, and which of its duties apply to you, depends on what you are, how you are authorised and how your Member State and your supervisor apply it: confirm it with counsel or your competent authority.

This library does not say which ISO/IEC 27001 controls or NIST CSF outcomes meet a DORA requirement. It gives each article's own words, what an entity must be able to show, and the CISO Times documents that help with the work. Where the CISO Times Library holds a mapping between a DORA requirement and a control, it shows it there with how closely the two match and where they differ; confirm it against both texts before relying on it. A document listed here helps with the work a requirement describes. Using it does not by itself show that the requirement is met.

The idea of the pack: DORA is one regulation with five pillars: ICT risk management, ICT-related incident management and reporting, digital operational resilience testing, the management of ICT third-party risk, and information sharing. Every financial entity meets the same five pillars, and the depth of each depends on what the entity is. A microenterprise, a small investment firm, an exempted payment institution and a large bank each owe a different part of each pillar, and the Regulation says which. So the first question is what you are, the second is which duties that makes yours, and only then is it worth asking how ready you are. Being ready is a count of duties in place and duties still open. It is never one score.

Why priority follows supervisory exposure. Priority 1 (Exposed now): A blocking gap: a duty that binds the entity is not in place at all. Priority 2 (Exposed on request): A binding duty that is in place but not operating: a request for evidence of implementation would find it incomplete. Priority 3 (Improvement): Any other item below Operating.

This tracker records and chases. It does not decide anything P09 decides, and it states no reporting clock: P09 owns incident response and every decision right, and P18 holds the DORA classification test and the reporting duties (DR-15).

EXAMPLE: Lantern Pay Services (EXAMPLE), a small authorised payment institution in an EU Member State, with 64 staff. Its first readiness self-assessment, as at 30 Sep 2026, gave Not ready. Lantern Pay Services (EXAMPLE): Not ready. 2 blocking gaps (TP-04, TP-05), each due 30 Oct 2026 or earlier; 6 other items below Operating, out of 19 that apply. It raised 8 gaps. Where a plan had already set an earlier date, the due date follows the plan (GAP-01, GAP-02, GAP-03, GAP-04, GAP-05, GAP-06). The next board meeting is on 22 Oct 2026.

Adapting this template:

• Replace the [[placeholders]] with your own values, and delete the EXAMPLE rows once you have entered your own. The formulas stay.

• On the Readiness Items sheet, set 'Applies to the entity?' and 'Binding duty?' from your scope assessment, not from the EXAMPLE. An entity under the simplified framework, a microenterprise and an entity that a TLPT authority has identified each have a different set of items that apply.

• Change the days to fix each priority on the Priorities sheet only if your own standard sets different ones. Keep them at least as strict as the days in DR-06.

• Use your own gap numbers if your risk or audit tracker has a scheme. Keep one ID for each gap for its whole life.

• Add your own columns to the right of the working columns, so the layout stays the same as the Summary and Headline Counts sheets expect.

• If one tracker already holds your audit and test findings, you may keep those there. Keep the columns this workbook calculates, so each finding still shows its priority, its due date and whether it is overdue.

• A supplier to a financial entity does not run the readiness assessment (DR-22). It can still use the Gaps sheet to follow the contract terms and information its customers ask for (FD-01 to FD-10): leave the readiness item empty, choose the source 'Test, audit or other finding' and set the priority yourself.

This workbook is your own record. Keep it where your authority, your auditors and your management body can reach it on request.

Gaps

EXAMPLE: 8 gaps as at 30 Sep 2026. Yellow columns are inputs; white columns calculate. One row for each gap. Overdue is measured at the As-at date on the Summary sheet.

Example	Gap ID	Source	Readiness item	Requirements (calc)	Evidence items (calc)	What is missing	Level when raised	Binding item? (calc)	Priority (calc)	Supervisory exposure (calc)	Change that closes it	Owner	Effort	Raised	Earlier planned date	Due (calc)	Status	Flag (calc)
EXAMPLE	GAP-01	Self-assessment	RM-01	RQ-04, RQ-05, RQ-06, RQ-26	EV-02, EV-03	Non-executive director 2, appointed on 15 Jul 2026, is not yet trained	In place	Yes	Priority 2	Exposed on request	Induction training on 8 Oct 2026, recorded in the training record	The board	Small	30 Sep 2026	8 Oct 2026	8 Oct 2026	Open	Not yet due
EXAMPLE	GAP-02	Self-assessment	RM-04	RQ-12, RQ-13, RQ-23	EV-08, EV-09	No ICT risk assessment in the last 12 months for the legacy reporting server (SYS-06)	In place	Yes	Priority 2	Exposed on request	Assess the server under Article 8(7) and decide whether to retire it	Head of Information Security	Small	30 Sep 2026	13 Nov 2026	13 Nov 2026	In progress	Not yet due
EXAMPLE	GAP-03	Self-assessment	RM-06	RQ-16, RQ-17, RQ-18, RQ-19, RQ-24	EV-12, EV-13, EV-14	The test of the continuity, response and recovery plans for all functions was last run on 26 Aug 2025	In place	Yes	Priority 2	Exposed on request	Run the yearly plan test, with the cyber-attack and switchover scenarios, and report the deficiencies to the board	Head of Information Security	Medium	30 Sep 2026	30 Oct 2026	30 Oct 2026	In progress	Not yet due
EXAMPLE	GAP-04	Self-assessment	IM-02	RQ-29, RQ-31	EV-20	The signatories' access to the authority's reporting channel was last tested on 12 Aug 2025	In place	Yes	Priority 2	Exposed on request	Test access for every signatory and deputy, and record it (P18 RC-08)	Information Security Manager	Small	30 Sep 2026	16 Oct 2026	16 Oct 2026	Open	Not yet due
EXAMPLE	GAP-05	Self-assessment	RT-02	RQ-33	EV-23	The settlement API gateway (SYS-02) was last tested on 29 Aug 2025	In place	Yes	Priority 2	Exposed on request	Run the booked penetration test with the external tester	Security Assurance Lead	Small	30 Sep 2026	23 Oct 2026	23 Oct 2026	In progress	Not yet due
EXAMPLE	GAP-06	Self-assessment	TP-01	RQ-42, RQ-43	EV-25, EV-33	The register has no LEI or EUID for Hosting Subcontractor G, behind CA-001 (RV-03)	In place	Yes	Priority 2	Exposed on request	Ask Platform Provider A for the code under the contract, and complete the register	Head of Procurement	Small	30 Sep 2026	23 Oct 2026	23 Oct 2026	In progress	Not yet due
EXAMPLE	GAP-07	Self-assessment	TP-04	RQ-47, RQ-48	EV-30	The CA-001 contract lacks the Article 30(3) audit, access and TLPT terms	Planned	Yes	Priority 1	Exposed now	Sign the amendment drafted on 12 Sep 2026	General Counsel	Medium	30 Sep 2026		30 Oct 2026	In progress	Not yet due
EXAMPLE	GAP-08	Self-assessment	TP-05	RQ-49, RQ-50	EV-31, EV-32	No exit plan for CA-001, the one arrangement behind the critical function	Planned	Yes	Priority 1	Exposed now	Write, approve and test the exit plan, with alternatives and a transition plan	Head of Procurement	Large	30 Sep 2026		30 Oct 2026	Open	Not yet due

Readiness Items

The readiness items of the DORA Readiness Self-Assessment, with the level each had at the latest assessment. Set 'Applies' and 'Binding' from your scope assessment: an item applies when any of its requirements applies to you, and binds when an applicable requirement is a duty and not an option. Add any item of your own on a blank row.

Example	Item ID	Area	Readiness item	Requirements	Evidence items	Applies to the entity?	Binding duty?	Latest level	What the rating rests on, or the reason if Not applicable	Open gaps (calc)	Priority a gap would take (calc)	Check (calc)
EXAMPLE	SC-01	Scope and proportionality	Scope, profile and proportionality decided and recorded	RQ-01, RQ-02	EV-01	Yes	Yes	Operating	Scope assessment approved by the board on 21 Nov 2024 and reviewed on 4 Mar 2026; confirmed by counsel; no trigger since.	0	None	OK
EXAMPLE	RM-01	ICT risk management	The management body governs ICT risk	RQ-04, RQ-05, RQ-06, RQ-26	EV-02, EV-03	Yes	Yes	In place	4 of 5 members trained in the last 12 months; the member appointed on 15 Jul 2026 is booked for 8 Oct 2026, inside the 3 months.	1	Priority 2	OK
EXAMPLE	RM-02	ICT risk management	The ICT risk management framework is documented, approved and reviewed	RQ-03, RQ-07, RQ-09, RQ-10, RQ-25	EV-04, EV-05, EV-06	Yes	Yes	Operating	Framework, strategy and risk tolerance approved by the board on 12 Mar 2026, with the review report in the Regulation's format.	0	None	OK
EXAMPLE	RM-03	ICT risk management	ICT risk control, independence and audit	RQ-08	EV-07	Yes	Yes	Operating	The second-line risk function oversees ICT risk; internal audit reviewed the framework in 2025 and its critical finding was closed.	0	None	OK
EXAMPLE	RM-04	ICT risk management	Functions, assets and dependencies identified and assessed	RQ-12, RQ-13, RQ-23	EV-08, EV-09	Yes	Yes	In place	Inventories are current and reviewed. The legacy back-office reporting server (SYS-06) has no ICT risk assessment in the last 12 months.	1	Priority 2	OK
EXAMPLE	RM-05	ICT risk management	Protection, detection and resilient systems	RQ-11, RQ-14, RQ-15	EV-10, EV-11	Yes	Yes	Operating	Information security, access, authentication, change and patch policies operate with records; detection alerts are tested each quarter.	0	None	OK
EXAMPLE	RM-06	ICT risk management	Continuity, backup and recovery planned and tested	RQ-16, RQ-17, RQ-18, RQ-19, RQ-24	EV-12, EV-13, EV-14	Yes	Yes	In place	Continuity policy, plans and business impact analysis approved; the plan test for all functions was last run on 26 Aug 2025 and fell due on 26 Aug 2026. The crisis communication plan was tested on 24 Feb 2026.	1	Priority 2	OK
EXAMPLE	RM-07	ICT risk management	Learning, training and crisis communication	RQ-20, RQ-21, RQ-22	EV-15, EV-16, EV-17	Yes	Yes	Operating	Post-incident reviews feed the risk register; all staff completed the compulsory module; a named person speaks for the entity in a crisis.	0	None	OK
EXAMPLE	IM-01	ICT-related incident management, classification and reporting	Incidents managed, logged and classified	RQ-27, RQ-28	EV-18, EV-19	Yes	Yes	Operating	Every incident is logged and classified against the criteria; the Q3 log has no major incident.	0	None	OK
EXAMPLE	IM-02	ICT-related incident management, classification and reporting	Major incidents can be reported on time	RQ-29, RQ-31	EV-20	Yes	Yes	In place	Authority, channel, templates and signatories are ready (P18). The signatories' access to the authority's channel was last tested on 2025-08-12, more than 12 months ago.	1	Priority 2	OK
EXAMPLE	RT-01	Digital operational resilience testing	A risk-based resilience testing programme	RQ-32, RQ-34, RQ-35, RQ-36, RQ-40	EV-21, EV-22	Yes	Yes	Operating	The programme was approved on 2026-01-28, uses independent testers and has a finding register with validated closure.	0	None	OK
EXAMPLE	RT-02	Digital operational resilience testing	Systems behind critical or important functions tested every 12 months	RQ-33	EV-23	Yes	Yes	In place	4 of 5 systems behind the critical function have a counting test in the last 12 months; SYS-02 fell due on 29 Aug 2026.	1	Priority 2	OK
EXAMPLE	RT-03	Digital operational resilience testing	Threat-led penetration testing, if the entity is identified	RQ-37, RQ-38, RQ-39	EV-24	No	No	Not applicable	A TLPT authority has not identified the entity	0	None	OK
EXAMPLE	TP-01	Management of ICT third-party risk	The register of information is complete and valid	RQ-42, RQ-43	EV-25, EV-33	Yes	Yes	In place	7 arrangements in the register, submitted on 27 Mar 2026; 1 open data finding (RV-03: the code of Hosting Subcontractor G).	1	Priority 2	OK
EXAMPLE	TP-02	Management of ICT third-party risk	Third-party strategy, policy and monitoring role	RQ-41, RQ-44, RQ-45	EV-26, EV-27	Yes	Yes	Operating	Strategy and policy approved by the board on 10 Jun 2026; the Head of Procurement is the designated manager.	0	None	OK
EXAMPLE	TP-03	Management of ICT third-party risk	Assessment before contracting, audit and concentration	RQ-46, RQ-51	EV-28, EV-29	Yes	Yes	Operating	The pre-contract assessment and concentration check for CA-001 are on file; the provider was checked against the ESAs' list on 2026-09-21.	0	None	OK
EXAMPLE	TP-04	Management of ICT third-party risk	Contract terms in place	RQ-47, RQ-48	EV-30	Yes	Yes	Planned	CA-001, signed in 2022, lacks the unrestricted audit and access wording and the TLPT participation term of Article 30(3). An amendment was drafted on 2026-09-12 and is not signed.	1	Priority 1	OK
EXAMPLE	TP-05	Management of ICT third-party risk	Exit plans and subcontracting for critical or important arrangements	RQ-49, RQ-50	EV-31, EV-32	Yes	Yes	Planned	CA-001 has no exit plan (B_07.01.0080 is No). The approach is agreed; the plan is not written. Hosting Subcontractor G has no LEI yet.	1	Priority 1	OK
EXAMPLE	IS-01	Information sharing	Information sharing and threat notification: a decision	RQ-52, RQ-30	EV-34	Yes	No	Operating	The board decided on 10 Jun 2026 not to join an information-sharing community yet; the decision is recorded. Significant cyber threats are notified only on the incident manager's judgement (Article 19(2) is optional).	0	None	OK
EXAMPLE	SV-01	Supervision	Evidence ready for the competent authority			Yes	No	Operating	25 of 33 evidence items ready; the 8 not fully ready are each behind a gap in the tracker.	0	None	OK

Summary

Summary

Calculated from the Gaps sheet at the As-at date. Take it to the management body with the readiness counts. Counts only: no score, no percentage (DR-04).

EXAMPLE: Lantern Pay's gaps. Delete the EXAMPLE rows to use your own.

As-at date	30 Sep 2026	EXAMPLE: the date of the first self-assessment. Use today's date, or type =TODAY().
Next management body meeting	22 Oct 2026	EXAMPLE: the next board meeting.
Working days to tell the chair (DR-05)	10	Monday to Friday. Public holidays are yours to allow for.

Headline

Measure	Result
Open gaps (Open or In progress)	8
Priority 1 open: blocking gaps	2
Overdue	0
Next due date	8 Oct 2026
Next due gap	GAP-01
Due on or before the next management body meeting	2
Applicable items below Operating with no open gap	0

Blocking gaps and the management body (DR-05)

Measure	Result
Earliest raised, open Priority 1 gap	30 Sep 2026
Working days from then to the next management body meeting	16
Route	Tell the chair	The chair is told within the working days above when the next meeting is further away (DR-05).
Date by which the management body or its chair is told	14 Oct 2026

Gaps by priority

Priority	Exposure	Deadline (days)	Open	In progress	Earliest open due
Priority 1	Exposed now	30	1	1	30 Oct 2026
Priority 2	Exposed on request	90	2	4	8 Oct 2026
Priority 3	Improvement	180	0	0
All priorities			3	5	8 Oct 2026

Open gaps by effort

Effort	What it means	Priority 1 (blocking)	Priority 2	All open
Small	Under [[2]] weeks of work, inside one team, within budget.	0	5	5
Medium	[[2]] to [[8]] weeks, or two or more teams, within budget.	1	1	2
Large	More than [[8]] weeks, or money the budget does not hold.	1	0	1

Open gaps by owner

Owner	Open	Earliest open due
The board	1	8 Oct 2026
Head of Information Security	2	30 Oct 2026
Information Security Manager	1	16 Oct 2026
Security Assurance Lead	1	23 Oct 2026
Head of Procurement	2	23 Oct 2026
General Counsel	1	30 Oct 2026

Type each owner once, as the Gaps sheet names them. EXAMPLE: the owners of the 8 example gaps.

Report to the management body

Item	Entry
Reported by (name, role) and date	[[Name, role, YYYY-MM-DD]]
Priority 1 gaps reported under DR-05: to whom and when	EXAMPLE: GAP-07 and GAP-08 (Priority 1) raised on 30 Sep 2026. The next board meeting, on 22 Oct 2026, is 16 working days away, more than 10, so the Head of Compliance tells the chair by 14 Oct 2026.
Gaps withdrawn, with the management body's reason and minute reference	[[e.g. none]]
Decisions asked of the management body	EXAMPLE: D-1 Approve the amendment to the CA-001 contract and authorise signature (closes GAP-07, by 22 Oct 2026); D-2 Approve the exit plan approach and budget for CA-001, and the date for the first test (closes GAP-08, by 22 Oct 2026).

Headline Counts

Headline counts

The eight headline measures DM-01 to DM-08 as counts with the names beside them. A count is never a score, a percentage or a traffic-light total (DR-04). Report them to the management body with the DORA Readiness Self-Assessment result.

Readiness items at each level (DM-01)

Level	Count	Items	Names (working)
Operating	11	SC-01, RM-02, RM-03, RM-05, RM-07, IM-01, RT-01, TP-02, TP-03, IS-01, SV-01	SC-01, RM-02, RM-03, RM-05, RM-07, IM-01, RT-01, TP-02, TP-03, IS-01, SV-01,
In place	6	RM-01, RM-04, RM-06, IM-02, RT-02, TP-01	RM-01, RM-04, RM-06, IM-02, RT-02, TP-01,
Planned	2	TP-04, TP-05	TP-04, TP-05,
Not started	0
Not applicable	1	RT-03	RT-03,
Applicable items rated (Operating to Not started)	19	Not applicable is counted apart, with its reason on the Readiness Items sheet (DR-03).

Headline measures

Measure	Count	Out of	Result	Named	Target	What it counts	Comes from	Names (working)
DM-01: Readiness items at each level	11	19	11 Operating, 6 In place, 2 Planned, 0 Not started, out of 19	See the table above.	All Operating	The applicable readiness items rated Operating, In place, Planned and Not started, with Not applicable counted apart, each count beside the names of the items.	This workbook: Readiness Items sheet
DM-02: Blocking gaps	2	19	2 of 19: TP-04, TP-05	TP-04, TP-05	None	Binding readiness items rated below In place, out of the applicable items, named.	This workbook: Readiness Items sheet	TP-04, TP-05,
DM-03: Register findings	1	7	1 of 7 arrangements	CA-001	None open	Arrangements with an open data finding (RV-01 to RV-10), out of all arrangements, named.	ICT Third-Party Arrangements Register — Working Copy
DM-04: Exit plans in place	0	1	0 of 1 arrangement	CA-001	All	Arrangements that support a critical or important function and have an exit plan, out of all such arrangements, named.	ICT Third-Party Arrangements Register — Working Copy
DM-05: Systems tested in time	4	5	4 of 5 systems	SYS-02	All	Systems behind critical or important functions whose yearly test is not overdue, out of all such systems, with the others named. A system is not overdue when its latest counting test is within the last 12 months, or when it has none and its first yearly test is not yet due.	Digital Operational Resilience Testing Programme
DM-06: Gaps open and overdue	8		8 open: 2 Priority 1, 6 Priority 2; 0 overdue		None overdue	Open gaps by priority, with those past their due date named.	This workbook: Gaps sheet
DM-07: Management body members trained	4	5	4 of 5 members	Non-executive director 2, booked for 8 Oct 2026	All	Members trained in the last 12 months, or within 3 months of appointment, out of all members, named.	The management body's training record (EV-03)
DM-08: Evidence items ready	25	33	25 of 33 items	EV-03, EV-09, EV-14, EV-20, EV-23, EV-25, EV-30, EV-31	All ready	Applicable evidence items rated Ready, out of the applicable items, with the others named.	DORA Documentation & Evidence Checklist

EXAMPLE: Lantern Pay, as at 30 Sep 2026. The yellow counts for DM-03, DM-04, DM-05, DM-07 and DM-08 come from the documents named in the last column. Delete them and enter your own. Name the others beside each count.

DM-01, DM-02 and DM-06 calculate from the Readiness Items and Gaps sheets.

Priorities

Priorities, levels, statuses and columns

Priority follows supervisory exposure, and the days to fix are P10's finding deadlines: 30, 90, 180 (DR-06). Change a yellow day count only if your own standard sets a different one, and keep it at least as strict. Counts only: no score, no percentage (DR-04).

Priority	Exposure	When it applies	Days to fix
Priority 1	Exposed now	A blocking gap: a duty that binds the entity is not in place at all.	30
Priority 2	Exposed on request	A binding duty that is in place but not operating: a request for evidence of implementation would find it incomplete.	90
Priority 3	Improvement	Any other item below Operating.	180

Level and priority for a self-assessment gap (DR-05)

Level when raised	Binding item	Other item
Not started	Priority 1	Priority 3
Planned	Priority 1	Priority 3
In place	Priority 2	Priority 3
Operating	No gap	No gap
Not applicable	No gap	No gap
A binding item is one whose requirements bind the entity as duties. A readiness item that is binding on this entity type (its requirements apply to the entity and are duties, not options) and is rated below In place. A blocking gap is a duty that is not in place at all.

Statuses of a gap

Status	Meaning
Open	Agreed, not started.
In progress	Work started; due date unchanged.
Done	The change is made and its record is filed; the item is re-rated at the next assessment.
Withdrawn	Dropped, with the management body's recorded reason.

Effort

Effort	What it means
Small	Under [[2]] weeks of work, inside one team, within budget.
Medium	[[2]] to [[8]] weeks, or two or more teams, within budget.
Large	More than [[8]] weeks, or money the budget does not hold.

Rules this tracker applies

Rule	What it says
DR-04	Readiness is a count with names, such as 2 of 5, and one of three result words. It is never a score, a percentage or a traffic-light total.
DR-05	A blocking gap is a readiness item that is binding on your entity type and is rated below In place. Every blocking gap is entered in the gap tracker as Priority 1 on the day it is found. It goes to the management body at its next meeting. If that meeting is more than [[10]] working days away, the DORA programme lead tells its chair within that time. Any other gap rated Priority 1 follows the same route, whatever its source.
DR-06	Every gap has an owner, an effort and a due date. The due date is the assessment date plus [[30]] days for Priority 1, [[90]] days for Priority 2 and [[180]] days for Priority 3, or an earlier date a plan already sets.
DR-14	Every test finding is entered in the gap tracker with an owner, a priority and a due date. A person other than the one who fixed it confirms that the weakness is fully addressed (Article 24(5)).

What to enter in each column of the Gaps sheet

Column	What to enter
Gap ID	GAP-nn. One ID for each gap for its whole life.
Source	Self-assessment for a readiness item rated below Operating. Test, audit or other finding for a weakness found by a test (DR-14), an audit, a post-incident review or a supervisor.
Readiness item	The item from the Readiness Items sheet. Required for a self-assessment gap. Optional for any other finding.
What is missing	A fact, not an opinion: what the check found, with the date and the system or contract.
Level when raised	The item's level at the assessment that raised the gap. Self-assessment gaps only. The priority follows from it and does not move when the item is re-rated.
Priority for a finding from another source	Choose the priority whose description on this sheet fits. Leave empty for a self-assessment gap: the workbook sets it.
Change that closes it	The document, control, contract term or record it adds or changes.
Owner	One role, and the person who holds it.
Effort	Small, Medium or Large, as the Effort table on this sheet defines.
Raised	The date of the assessment or finding. The due date counts from it (DR-06).
Earlier planned date	A date a plan already set, if it is earlier than the priority's deadline. The due date then follows the plan.
Status	Open, In progress, Done or Withdrawn.
Done	The date the change was made.
Evidence	Where the record is filed, so the evidence checklist can point to it. For a withdrawn gap, the management body's reason and the minute reference.
Closure confirmed by	Findings from another source only. A person other than the one who fixed the weakness confirms that it is fully addressed (DR-14, Article 24(5)).

Lists

ItemID	Level	Effort	GapStatus	Source	YesNo
SC-01	Not started	Small	Open	Self-assessment	Yes
RM-01	Planned	Medium	In progress	Test, audit or other finding	No
RM-02	In place	Large	Done
RM-03	Operating		Withdrawn
RM-04	Not applicable

RM-05

RM-06

RM-07

IM-01

IM-02

RT-01

RT-02

RT-03

TP-01

TP-02

TP-03

TP-04

TP-05

IS-01

SV-01

Definitions

Definitions

Term	Meaning in this workbook
Gap	A readiness item below Operating at a self-assessment, or a weakness found by a test, an audit or a supervisor, and the work that closes it.
Blocking gap	A readiness item that is binding on this entity type (its requirements apply to the entity and are duties, not options) and is rated below In place. A blocking gap is a duty that is not in place at all.
Readiness item	One of the readiness items, such as IM-01: a group of requirements that the readiness self-assessment rates in words (Not started, Planned, In place or Operating), never as a score.
Profile	The result of the scope assessment for one entity: its regime (the full framework, the simplified framework, out of scope, or supplier), whether it is a microenterprise, whether a TLPT authority has identified it, and the requirements that follow.
Source	Self-assessment: the gap comes from a readiness item, and its priority is set by formula. Test, audit or other finding: the owner chooses the priority (DR-14).
Priority 1: Exposed now	A blocking gap: a duty that binds the entity is not in place at all. Due within 30 calendar days of the date raised, or by an earlier date a plan already set (DR-06).
Priority 2: Exposed on request	A binding duty that is in place but not operating: a request for evidence of implementation would find it incomplete. Due within 90 calendar days of the date raised, or by an earlier date a plan already set (DR-06).
Priority 3: Improvement	Any other item below Operating. Due within 180 calendar days of the date raised, or by an earlier date a plan already set (DR-06).
Status: Open	Agreed, not started.
Status: In progress	Work started; due date unchanged.
Status: Done	The change is made and its record is filed; the item is re-rated at the next assessment.
Status: Withdrawn	Dropped, with the management body's recorded reason.
Effort: Small	Under [[2]] weeks of work, inside one team, within budget.
Effort: Medium	[[2]] to [[8]] weeks, or two or more teams, within budget.
Effort: Large	More than [[8]] weeks, or money the budget does not hold.
Readiness level	One of the four words the self-assessment uses, in order from Not started to Operating, or Not applicable with its reason.
Level: Not started	Nothing exists yet.
Level: Planned	Owner and approach agreed; not yet in place.
Level: In place	Documented and working, but incomplete, short of its own target, or with too little record for a supervisor to sample.
Level: Operating	Working in full and meeting its own target, with records a supervisor could sample.
Level: Not applicable	The duty does not apply to the entity. The reason must be recorded, and confirmed with counsel.
Applies, Binding	Set from the scope assessment. An item applies when any of its requirements applies to the entity. It is binding when an applicable requirement is a duty and not an option.
Overdue	A gap that is Open or In progress and whose due date is before the As-at date.
Closure confirmed by	For a finding from another source, the person other than the one who fixed the weakness who confirms that it is fully addressed (Article 24(5), DR-14).
Headline measures DM-01 to DM-08	The eight measures of the pack, reported as counts with names: DM-01 readiness items at each level; DM-02 blocking gaps; DM-03 register findings; DM-04 exit plans in place; DM-05 systems tested in time; DM-06 gaps open and overdue; DM-07 management body members trained; DM-08 evidence items ready.
(calc), (working)	A column the workbook calculates. Do not type or paste over it. Working columns hold helper values and may be hidden from print.
DR-nn, DM-nn, RQ-nn, EV-nn	Rules, measures, requirements and evidence items of the pack. The DORA Article-to-Control Mapping Library lists the requirements and the DORA Documentation & Evidence Checklist lists the evidence items.
EXAMPLE	A worked example: a small authorised payment institution in an EU Member State, with 64 staff, as at 2026-09-30. Delete the EXAMPLE rows before approval.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 10.2 — Nonconformity and corrective action	Gaps sheet: each nonconformity followed to a corrective action, with its cause, its change and its record
NIST CSF 2.0	ID.IM-01 — “Improvements are identified from evaluations”	Gaps and Readiness Items sheets: improvements identified from the self-assessment, owned and dated
DORA — Regulation (EU) 2022/2554	Article 4 — financial entities implement the rules of Chapter II in line with proportionality, taking into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations; Chapters III, IV and V, Section I, apply proportionately “as specifically provided for in the relevant rules of those Chapters”; competent authorities consider how the entity applied proportionality when they review its ICT risk management framework on the reports submitted under Articles 6(5) and 16(2)	Readiness Items sheet: whether an item applies to the entity, and whether it binds, follows the entity's profile, as the proportionality rules require
DORA — Regulation (EU) 2022/2554	Article 6(5) — the ICT risk management framework is documented and reviewed at least once a year (periodically for microenterprises), upon major ICT-related incidents, and following supervisory instructions or conclusions from digital operational resilience testing or audit processes; “It shall be continuously improved on the basis of lessons derived from implementation and monitoring.” A report on the review is submitted to the competent authority on request	Gaps sheet: the framework is continuously improved on lessons from its implementation and monitoring; each gap from the yearly review has an owner and a date
DORA — Regulation (EU) 2022/2554	Article 6(7) — “Based on the conclusions from the internal audit review, financial entities shall establish a formal follow-up process, including rules for the timely verification and remediation of critical ICT audit findings.”	Gaps sheet: a follow-up that verifies and remedies critical audit findings in time, using the source "Test, audit or other finding"
DORA — Regulation (EU) 2022/2554	Article 13(2) — post ICT-related incident reviews after a major ICT-related incident disrupts core activities, analysing the causes and identifying improvements; financial entities other than microenterprises tell the competent authorities on request what changed as a result; the reviews determine whether procedures were followed and actions effective, including the promptness of response, the quality and speed of any forensic analysis, the effectiveness of escalation, and internal and external communication	Gaps sheet: the improvements that a post-incident review identifies, tracked to the change they lead to
DORA — Regulation (EU) 2022/2554	Article 13(3) — lessons from resilience testing and from real ICT-related incidents are incorporated on a continuous basis into the ICT risk assessment process	Gaps sheet: lessons from resilience tests and real incidents carried into the risk assessment as dated actions
DORA — Regulation (EU) 2022/2554	Article 24(5) — procedures and policies to prioritise, classify and remedy all issues revealed by the tests, and internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed	Gaps sheet: every issue a test reveals is prioritised, owned and dated, and closed only when another person confirms it is fully addressed
DORA — Delegated Regulation (EU) 2024/1774	Article 25(5) — “Financial entities shall document the results of the testing referred to in paragraph 1. Any identified deficiencies resulting from that testing shall be analysed, addressed, and reported to the management body.”	Gaps and Headline Counts sheets: deficiencies from plan tests analysed, addressed and counted for the management body
DORA — Delegated Regulation (EU) 2024/1774	Article 27(2) — the report on the review of the ICT risk management framework (DORA Article 6(5)), in a searchable electronic format, contains an introduction and executive summary, the date of the management body’s approval, the reason for the review, the review period, the function responsible, major changes since the previous review, a summary of findings with the severity of weaknesses, deficiencies and gaps, the measures to address them with dates, resources and the function responsible, planned developments, conclusions, information on past reviews and the sources used, including internal audit results (other than for microenterprises), compliance assessments, resilience testing results and external sources	Gaps sheet: the findings, the measures with their dates and the function responsible, which the review report lists. The report is written elsewhere
DORA — Delegated Regulation (EU) 2024/1774	Article 40(3) — the results of the testing are documented, and identified deficiencies “shall be analysed, addressed, and reported to the management body”	Gaps and Headline Counts sheets: deficiencies from backup and restore tests under the simplified framework, analysed, addressed and counted for the management body
DORA — Delegated Regulation (EU) 2024/1774	Article 41(2) — the report on the review of the simplified ICT risk management framework, submitted in a searchable electronic format, contains an introduction and executive summary, the date of the management body’s approval where applicable, the reasons for the review, the review period, the person responsible, a summary of findings with a self-assessment of the severity of weaknesses, deficiencies and gaps, the remedying measures with expected dates and the follow-up on earlier gaps, and overall conclusions	Gaps sheet: the remedying measures with expected dates and the follow-up on earlier gaps, for the review report of the simplified framework

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Regulation (EU) 2022/2554 (DORA); Delegated Regulations (EU) 2024/1772, 2024/1773, 2024/1774, 2025/301, 2025/532 and 2025/1190; Implementing Regulations (EU) 2024/2956 and 2025/302; as published in the Official Journal and read on 8 October 2026

ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. They do not say that meeting one meets any DORA requirement.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.

Regulation (EU) 2022/2554 binds the financial entities of its Article 2(1), points (a) to (t), except those Article 2(3) excludes and any that a Member State excludes under Article 2(4). Articles 5 to 15 do not apply to the entities of its Article 16(1), which follow Article 16 and Title III of Delegated Regulation (EU) 2024/1774. Several duties do not apply to microenterprises, and the Regulation says where. It reaches an ICT third-party service provider through the contract with a financial entity and, for a provider designated as critical, through the oversight framework of Chapter V, Section II.

The Delegated and Implementing Regulations bind the same financial entities as the Regulation they supplement, for the articles each applies to. Title II of Delegated Regulation (EU) 2024/1774 is for the entities that follow Articles 5 to 15; its Title III is for the entities of DORA Article 16(1). Delegated Regulation (EU) 2025/1190 binds only the entities that a TLPT authority identifies.

The competent authority for each financial entity is the one DORA Article 46 names for its type. National law and the authority's own instructions set the dates and channels for the register of information and for reports. None of them is stated here.