DORA Proportionality & Scope Assessment
Determines entity type, applicable requirements and eligibility for the simplified ICT risk framework.
Available soon
Answer it online instead: Does DORA apply to us?About 10 minutes, free, and nothing is stored.
- Format
- Excel
- Size
- 85 KB
- Length
- 12 sheets
- Version
- 1.2
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.2
The mappings note no longer says the CISO Times Library shows a verification state; it says what a mapping shows and to confirm it against both texts.
- 1.1
A financial entity that sells ICT services is also a supplier, and any Priority 1 gap goes to the chair route.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Gather the facts first, with legal: your authorisation or licence, any exemption letter, the latest approved accounts, your headcount and any letter from your competent authority. The DORA programme lead ([[e.g. Head of Compliance or Chief Risk Officer]]) owns the assessment. |
| 2 | On the Assessment sheet, answer Q1 to Q8 in order from the drop-down lists. For each, record the fact, where it comes from (a licence, the accounts, a letter) and your reasoning. The Check column says what is missing. A question that your earlier answers make irrelevant reads "Not needed". |
| 3 | Q1: choose what you are, or "Not a financial entity" if none of the 20 kinds fits. Q2 and Q3 then ask whether you supply ICT services to a financial entity and whether the European Supervisory Authorities have designated you as critical. A supplier does not run the readiness assessment (DR-22). It uses the supplier list on the Result sheet. |
| 4 | Q4 and Q5: read the exclusions of Article 2(3) and the entities of Article 16(1). Choose "None" only when none applies. Never choose either to lighten the work (DR-03). The Check column stops a choice that does not suit the kind of entity from Q1. |
| 5 | Q6 appears only for an institution exempted under Directive 2013/36/EU. Answer it from your Member State's decision on the Article 2(4) option. Where your competent authority tells you something different, its view stands (DR-01). |
| 6 | Q7: enter staff, turnover and balance sheet total in euros. A microenterprise has fewer than 10 staff and a turnover or balance sheet total of at most EUR 2 million. A central securities depository, a central counterparty, a trading venue and a trade repository are never microenterprises. A blank figure counts against being one. |
| 7 | Q8: answer Yes only if a TLPT authority has told you in writing that it identifies you. Never plan threat-led penetration testing before that (DR-16). |
| 8 | Read the Result sheet: the regime, microenterprise status, what follows for TLPT, how many requirements apply, the reasons and the count for each pillar. The Requirements sheet marks every requirement Yes or No, with the reason for each No. The Decision Table sheet holds the tables the formulas read. Do not change it. |
| 9 | Have counsel confirm the result against your Member State's law and your authority's instructions (DR-01, DR-21). Then the management body approves it. Record both in the sign-off on the Result sheet. |
| 10 | Use the profile in the DORA Article-to-Control Mapping Library and the DORA Readiness Self-Assessment, which rates the readiness items that apply to your profile. Repeat this assessment at least every 12 months, and when a figure, a licence or the Member State's use of Article 2(4) changes (DR-01). |
| 11 | The Test Cases sheet runs 21 typical cases through the same formulas. Add a case of your own on a blank row. |
| 12 | To clear the EXAMPLE, delete the word EXAMPLE in E5 of the Assessment sheet and replace every yellow cell there and in the sign-off. Keep this workbook with your own records. It is a file you keep, not a place to record anything on a website. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
The idea behind this workbook. DORA is one regulation with five pillars: ICT risk management, ICT-related incident management and reporting, digital operational resilience testing, the management of ICT third-party risk, and information sharing. Every financial entity meets the same five pillars, and the depth of each depends on what the entity is. A microenterprise, a small investment firm, an exempted payment institution and a large bank each owe a different part of each pillar, and the Regulation says which. So the first question is what you are, the second is which duties that makes yours, and only then is it worth asking how ready you are. Being ready is a count of duties in place and duties still open. It is never one score.
What this workbook does not do. This workbook does not say which ISO/IEC 27001 controls or NIST CSF outcomes meet a DORA requirement. It gives each article's own words, what an entity must be able to show, and the CISO Times documents that help with the work. Where the CISO Times Library holds a mapping between a DORA requirement and a control, it shows it there with how closely the two match and where they differ; confirm it against both texts before relying on it. A document listed here helps with the work a requirement describes. Using it does not by itself show that the requirement is met. It states no incident reporting clock: P09 and P18 hold those.
EXAMPLE: Lantern Pay Services (EXAMPLE) is a small authorised payment institution in an EU Member State, with 64 staff. Its payment services for online merchants make it an authorised payment institution that is not exempted, so it follows the full framework of Articles 5 to 15. With 64 staff it is not a microenterprise, and no TLPT authority has identified it. Position as at 30 Sep 2026.
Adapting this workbook
Group: These documents work at the level of one entity. A group keeps the register at sub-consolidated and consolidated level as well (Implementing Regulation 2024/2956 Articles 3 and 6), and takes advice on that.
Supplier to a financial entity: answer Q1 with "Not a financial entity", Q2 Yes, and Q3 from the ESAs' list of designated providers. The Result sheet then gives the supplier path.
Small entity: answer every question all the same. The size test (Q7) and the framework (Q5) change the depth of nearly every pillar.
Assessment
Scope assessment
Answer every question from the list, and record the fact, its source and your reasoning. Yellow cells are yours; grey cells are calculated.
| Worked example | EXAMPLE | Delete EXAMPLE here, and replace every yellow cell, to record your own assessment. | ||||
| Entity (legal name) | Lantern Pay Services (EXAMPLE) | |||||
| What it does | EXAMPLE: payment services for online merchants | |||||
| Member State where it is authorised | IE | |||||
| Competent authority | [[competent authority designated under DORA Article 46]] | |||||
| Position as at | 30 Sep 2026 | |||||
| Management body first approved the assessment on | 21 Nov 2024 | |||||
| Assessment last reviewed on | 4 Mar 2026 | |||||
| Assessed by | Head of Compliance (DORA programme lead) | |||||
| ID | Question | DORA article | Your answer | Fact and its source | Reasoning | Check |
|---|---|---|---|---|---|---|
| Q1 | What is the organisation? Choose the kind of financial entity, or Not a financial entity. | Article 2(1), points (a) to (t) | Payment institution (including an exempted payment institution) | Lantern Pay is an authorised payment institution under Directive (EU) 2015/2366 that is not an exempted one, providing payment services for online merchants. Source: [[the authorisation letter and its date]] | Payment institution (including an exempted payment institution): a financial entity (Article 2(1), point (b)). | OK |
| Q2 | If it is not a financial entity: does it provide ICT services to one? | Article 2(1), point (u); Article 30 | Not asked: the organisation is a financial entity. | Not needed | ||
| Q3 | If it provides ICT services to a financial entity: have the European Supervisory Authorities designated it as critical? | Article 31(1) | Not asked: the organisation is a financial entity. | Not needed | ||
| Q4 | Does an exclusion of Article 2(3) apply? | Article 2(3) | None | No exclusion applies. Source: [[the counsel's note on Article 2(3)]] | An authorised payment institution is not one of the entities Article 2(3) excludes. | OK |
| Q5 | Is the entity one that follows the simplified framework? | Article 16(1) | None | Lantern Pay is not an exempted payment institution. Source: [[the authorisation letter]] | Follows the full ICT risk management framework of Articles 5 to 15. | OK |
| Q6 | If it is an institution exempted under Directive 2013/36/EU: does the Member State exclude such institutions? | Article 2(4) | Not asked: no simplified-framework entry that Article 2(4) can switch off applies. | Not needed | ||
| Q7 | Is it a microenterprise? Enter staff, turnover and balance sheet total below. The answer is calculated. | Article 3(60) | No | 64 staff; turnover EUR 9.4 million; balance sheet total EUR 6.1 million. Source: [[the approved accounts and the payroll record]] | A microenterprise has fewer than 10 staff and turnover or a balance sheet total of at most EUR 2.0 million. Lantern Pay has 64 staff, so it is not one. | OK |
| Staff (persons employed) | 64 | |||||
| Annual turnover (€) | €9,400,000 | |||||
| Annual balance sheet total (€) | €6,100,000 | |||||
| Q8 | Has a TLPT authority identified the entity for threat-led penetration testing? | Article 26(1), (8) | No | No letter from a TLPT authority. Source: [[the register of letters from the competent authority]] | Not required unless a TLPT authority identifies the entity (Article 26(8)). Delegated Regulation 2025/1190 Article 2(2) names payment institutions that exceeded EUR 150 billion of total value of payment transactions in each of the 2 calendar years before the assessment; the authority may decide that the assessment does not justify TLPT. | OK |
Result
Result and the reasoning recorded
The profile the answers give, why, what follows for each pillar, the supplier path, and the sign-off. Everything above the sign-off is calculated.
EXAMPLE: Lantern Pay's assessment, as at 30 Sep 2026. Clear the EXAMPLE on the Assessment sheet to record your own.
The profile
| Regime | Full ICT risk management framework (DORA Articles 5 to 15) | |||
|---|---|---|---|---|
| Microenterprise | No | |||
| Threat-led penetration testing (TLPT) | Not required unless a TLPT authority identifies the entity (Article 26(8)). Delegated Regulation 2025/1190 Article 2(2) names payment institutions that exceeded EUR 150 billion of total value of payment transactions in each of the 2 calendar years before the assessment; the authority may decide that the assessment does not justify TLPT. | |||
| Requirements that apply | 41 of 52: 39 duties and 2 options | |||
| Next review due | 4 Mar 2027 | |||
| Review status | In date as at 2026-09-30 | |||
| Reasoning recorded | Complete: every answer has its fact, source and reasoning | |||
Why
| Reason 1 | Payment institution (including an exempted payment institution): a financial entity (Article 2(1), point (b)). | |||
| Reason 2 | Follows the full ICT risk management framework of Articles 5 to 15. | |||
Reason 3
Note 1
Note 2
Note 3
How the profile was worked out
Each step is one line of the rules in the Decision Table sheet. Nothing here is yours to change.
| 1. Kind of financial entity (ID) | payment | |||
2. Exclusion of Article 2(3) (ID)
3. Simplified framework entry (ID)
| 4. Regime | full | |||
| 5. Microenterprise | No | |||
| 6. Identified for TLPT | No | |||
| 7. Requirements that apply | 41 | |||
What follows, by pillar
| Pillar | Articles | Requirements that apply | Duties among them | Options among them |
|---|---|---|---|---|
| Scope and proportionality | Articles 2, 4 and 16 | 2 of 3 | 2 | 0 |
| ICT risk management | Chapter II, Articles 5 to 16 | 19 of 23 | 19 | 0 |
| ICT-related incident management, classification and reporting | Chapter III, Articles 17 to 23 | 5 of 5 | 4 | 1 |
| Digital operational resilience testing | Chapter IV, Articles 24 to 27 | 3 of 9 | 3 | 0 |
| Management of ICT third-party risk | Chapter V, Section I, Articles 28 to 30 | 11 of 11 | 11 | 0 |
| Information sharing | Chapter VI, Article 45 | 1 of 1 | 0 | 1 |
The Requirements sheet marks each requirement. A count is written as 'n of N', never as a share or a score.
If you supply ICT services to a financial entity
DORA lists ICT third-party service providers in Article 2(1), point (u), and defines financial entities as points (a) to (t) only. Its duties for the contract fall on the financial entity. A supplier is reached by DORA mainly through the terms its customers must ask for (the supplier flow-down list) and the information they must collect. A supplier designated as critical is also overseen by a Lead Overseer.
| Term (FD) | Reference | What your customer must ask of you or collect from you | Your position | |
|---|---|---|---|---|
| FD-01 | DORA 30(1), DORA 30(2) | A written contract that describes the services and says whether, and on what terms, subcontracting is allowed; names the locations of the services and of the data, and gives advance notice of a change | Not for you: the assessment does not make you a supplier | |
| FD-02 | DORA 30(2) | Terms on the availability, authenticity, integrity and confidentiality of data, and on access to and return of the entity's data in an accessible format on the provider's insolvency or the end of the contract | Not for you: the assessment does not make you a supplier | |
| FD-03 | DORA 30(2) | Service levels, and assistance in an incident at no extra cost or at a cost agreed in advance | Not for you: the assessment does not make you a supplier | |
| FD-04 | DORA 30(2) | Full cooperation with the entity's competent and resolution authorities; termination rights and notice periods; taking part in the entity's awareness and resilience training | Not for you: the assessment does not make you a supplier | |
| FD-05 | DORA 30(3), DORA 30(3)(c), DORA 30(3)(d) | For a service supporting a critical or important function: full service levels with precise targets, notice and reporting duties, contingency plans and security measures that the provider implements and tests, and taking part in the entity's TLPT | Not for you: the assessment does not make you a supplier | |
| FD-06 | DORA 30(3)(e) | Unrestricted rights of access, inspection and audit for the entity and the authorities, and cooperation during on-site inspections | Not for you: the assessment does not make you a supplier | |
| FD-07 | DORA 30(3)(f), DORA 28(8) | An exit strategy with a mandatory adequate transition period | Not for you: the assessment does not make you a supplier | |
| FD-08 | RTS 532 4, RTS 532 5 | Subcontracting conditions: responsibility for subcontracted services, monitoring and reporting, the same access and audit rights, and notice of material changes with time for the entity to approve or object | Not for you: the assessment does not make you a supplier | |
| FD-09 | ITS 2956 3, ITS 2956 B_05 | The information the entity must enter in its register: the provider's legal name, a valid LEI or EUID, its ultimate parent, the country of its headquarters, and the same identifiers for the subcontractors behind a critical or important service | Not for you: the assessment does not make you a supplier | |
| FD-10 | DORA 31(1), DORA 31(9), DORA 31(12) | Where the ESAs designate the provider as critical: oversight by a Lead Overseer, a yearly list, and, for a provider established in a third country, a subsidiary in the Union within 12 months | Not for you: the assessment does not make you a supplier | |
Before you rely on it
Rule DR-01: "Decide what you are before anything else. Complete the scope assessment: the entity type (Article 2(1)), any exclusion (Article 2(3)), the simplified framework (Article 16(1)), whether you are a microenterprise (Article 3(60)) with the figures behind it, and whether a TLPT authority has identified you. The management body approves the assessment and counsel confirms it. Review it at least every [[12]] months, and whenever a figure, a licence or the Member State's use of Article 2(4) changes. Where your competent authority tells you something different, its view stands."
Rule DR-21: "The competent authority, its channels, the dates and the format for the register and for reports, the language, and anything national law adds, are placeholders filled from your authority's own instructions. None is stated in this pack."
Competent authority: [[competent authority designated under DORA Article 46]]. Anything national law adds: [[from your authority's own instructions]].
If a directive on the security of network and information systems (NIS2) also covers you, DORA Article 1(2) treats DORA as a sector-specific Union act for the purposes of Article 4 of that directive. Ask counsel what that means for you.
Regulation (EU) 2022/2554 binds the financial entities of its Article 2(1), points (a) to (t), except those Article 2(3) excludes and any that a Member State excludes under Article 2(4). Articles 5 to 15 do not apply to the entities of its Article 16(1), which follow Article 16 and Title III of Delegated Regulation (EU) 2024/1774. Several duties do not apply to microenterprises, and the Regulation says where. It reaches an ICT third-party service provider through the contract with a financial entity and, for a provider designated as critical, through the oversight framework of Chapter V, Section II.
The competent authority for each financial entity is the one DORA Article 46 names for its type. National law and the authority's own instructions set the dates and channels for the register of information and for reports. None of them is stated here.
Reassess when
• 12 months have passed since the last review (DR-01).
• Staff, turnover or balance sheet total changes in a way that could cross the microenterprise line.
• A licence, an authorisation or an exemption is granted, changed or withdrawn.
• Your Member State changes its use of the Article 2(4) option.
• A TLPT authority identifies the entity or withdraws its identification.
• The entity starts or stops providing ICT services to a financial entity.
Confirmation and approval (DR-01)
| Step | Date | Who | Reference | |
|---|---|---|---|---|
| Approved by the management body | 21 Nov 2024 | The board | [[minute reference]] | |
| Last reviewed | 4 Mar 2026 | Head of Compliance | [[review note reference]] | |
| Confirmed by counsel | [[date]] | General Counsel | [[counsel's letter reference]] | |
| The board approved the scope assessment on 21 Nov 2024 and reviewed it on 4 Mar 2026. Counsel confirmed it. No trigger has arisen since. | ||||
Requirements
The 52 requirements this pack relies on, read with the profile on the Result sheet. Yes means the requirement applies to the entity. A requirement marked Option is not a duty. Nothing on this sheet is yours to change.
| ID | Pillar | Article | Requirement | Applies to | Duty or option | What changes for a microenterprise | Rule | Entity types | Applies to you? | Why not |
|---|---|---|---|---|---|---|---|---|---|---|
| RQ-01 | SC | Article 2(1), (3), (4) | Know whether DORA binds you | Every financial entity in scope | Duty | all | Yes | |||
| RQ-02 | SC | Article 4 | Apply the rules in proportion | Every financial entity in scope | Duty | all | Yes | |||
| RQ-03 | SC | Article 16(1)(a) to (d); Delegated Regulation 2024/1774 Articles 29 to 38 | Run the simplified framework | Entities under the simplified framework (Article 16) | Duty | simplified | No | For entities under the simplified framework: the entity follows Articles 5 to 15 | ||
| RQ-04 | RM | Article 5(1), (2) | The management body owns ICT risk | Entities under the full framework (not the Article 16 entities) | Duty | full | Yes | |||
| RQ-05 | RM | Article 5(2)(i) | Reporting channels to the management body | Entities under the full framework (not the Article 16 entities) | Duty | full | Yes | |||
| RQ-06 | RM | Article 5(4) | Members keep their ICT knowledge current | Entities under the full framework (not the Article 16 entities) | Duty | full | Yes | |||
| RQ-07 | RM | Article 6(1) to (3) | A documented ICT risk management framework | Entities under the full framework (not the Article 16 entities) | Duty | full | Yes | |||
| RQ-08 | RM | Article 6(4), (6), (7) | Control function, three lines and ICT audit | Entities under the full framework, other than microenterprises | Duty | fullNotMicro | Yes | |||
| RQ-09 | RM | Article 6(5) | Review the framework every year and report on it | Entities under the full framework (not the Article 16 entities) | Duty | A microenterprise reviews the framework periodically, not necessarily every year (Article 6(5)). | full | Yes | ||
| RQ-10 | RM | Article 6(8) | A digital operational resilience strategy | Entities under the full framework (not the Article 16 entities) | Duty | full | Yes | |||
| RQ-11 | RM | Article 7 | Reliable, resilient systems | Entities under the full framework (not the Article 16 entities) | Duty | full | Yes | |||
| RQ-12 | RM | Article 8(1), (2), (4) to (6) | Know your functions, assets and dependencies | Entities under the full framework (not the Article 16 entities) | Duty | full | Yes | |||
| RQ-13 | RM | Article 8(3), (7) | Risk assessments on change and on legacy systems | Entities under the full framework, other than microenterprises | Duty | fullNotMicro | Yes | |||
| RQ-14 | RM | Article 9 | Protection and prevention | Entities under the full framework (not the Article 16 entities) | Duty | full | Yes | |||
| RQ-15 | RM | Article 10 | Detection | Entities under the full framework (not the Article 16 entities) | Duty | full | Yes | |||
| RQ-16 | RM | Article 11(1) to (5), (8) | Continuity policy, response and recovery plans | Entities under the full framework (not the Article 16 entities) | Duty | The independent internal audit review of the response and recovery plans (Article 11(3)) does not apply to a microenterprise. | full | Yes | ||
| RQ-17 | RM | Article 11(6) | Test the plans at least yearly | Entities under the full framework (not the Article 16 entities) | Duty | The cyber-attack and switchover scenarios (Article 11(6), second subparagraph) are for entities other than microenterprises. | full | Yes | ||
| RQ-18 | RM | Article 11(7) | A crisis management function | Entities under the full framework, other than microenterprises | Duty | fullNotMicro | Yes | |||
| RQ-19 | RM | Article 12 | Backup, restoration and recovery | Entities under the full framework (not the Article 16 entities) | Duty | A microenterprise assesses the need for redundant ICT capacity on its risk profile (Article 12(4)). | full | Yes | ||
| RQ-20 | RM | Article 13(1) to (3), (5) | Learn from incidents and tests | Entities under the full framework (not the Article 16 entities) | Duty | A microenterprise need not tell the authority, on request, which changes followed a post-incident review (Article 13(2)). | full | Yes | ||
| RQ-21 | RM | Article 13(6) | Awareness and resilience training for all staff | Entities under the full framework (not the Article 16 entities) | Duty | full | Yes | |||
| RQ-22 | RM | Article 14 | Crisis communication | Entities under the full framework (not the Article 16 entities) | Duty | full | Yes | |||
| RQ-23 | RM | Article 16(1)(e); Delegated Regulation 2024/1774 Article 30 | Key dependencies and critical functions | Entities under the simplified framework (Article 16) | Duty | simplified | No | For entities under the simplified framework: the entity follows Articles 5 to 15 | ||
| RQ-24 | RM | Article 16(1)(f), (g); Delegated Regulation 2024/1774 Articles 39 and 40 | Continuity, backup and restoration, and their tests | Entities under the simplified framework (Article 16) | Duty | simplified | No | For entities under the simplified framework: the entity follows Articles 5 to 15 | ||
| RQ-25 | RM | Article 16(1)(h), 16(2); Delegated Regulation 2024/1774 Article 41 | Lessons, training and the review report | Entities under the simplified framework (Article 16) | Duty | simplified | No | For entities under the simplified framework: the entity follows Articles 5 to 15 | ||
| RQ-26 | RM | Delegated Regulation 2024/1774 Article 28 | Governance under the simplified framework | Entities under the simplified framework (Article 16) | Duty | simplified | No | For entities under the simplified framework: the entity follows Articles 5 to 15 | ||
| RQ-27 | IM | Article 17 | An incident management process | Every financial entity in scope | Duty | all | Yes | |||
| RQ-28 | IM | Article 18; Delegated Regulation 2024/1772 | Classify incidents by the criteria | Every financial entity in scope | Duty | all | Yes | |||
| RQ-29 | IM | Article 19(1), (3), (4) | Report major incidents on time | Every financial entity in scope | Duty | all | Yes | |||
| RQ-30 | IM | Article 19(2) | Significant cyber threats (optional) | Every financial entity in scope | Option | all | Yes | |||
| RQ-31 | IM | Article 23 | Payment-related incidents | Every financial entity in scope (Credit institution, Payment institution (including an exempted payment institution), Account information service provider, Electronic money institution (including an exempted one) only) | Duty | all | credit,payment,aisp,emoney | Yes | ||
| RQ-32 | RT | Article 24(1) to (5) | A resilience testing programme | Every financial entity in scope other than microenterprises | Duty | allNotMicro | Yes | |||
| RQ-33 | RT | Article 24(6) | Test the systems behind critical functions every year | Every financial entity in scope other than microenterprises | Duty | allNotMicro | Yes | |||
| RQ-34 | RT | Article 25(1) | A range of tests | Every financial entity in scope | Duty | all | Yes | |||
| RQ-35 | RT | Article 25(3) | Microenterprises: risk-based testing | Microenterprises | Duty | micro | No | For microenterprises only | ||
| RQ-36 | RT | Article 25(2) | Vulnerability assessments before deployment | Every financial entity in scope (Central securities depository, Central counterparty only) | Duty | all | csd,ccp | No | For central securities depository, central counterparty only | |
| RQ-37 | RT | Article 26(1) to (3), (8) | Threat-led penetration testing (if identified) | Entities that a TLPT authority has identified | Duty | tlpt | No | A TLPT authority has not identified the entity | ||
| RQ-38 | RT | Article 26(6), (7); Delegated Regulation 2025/1190 Articles 12 and 13 | TLPT closure, remediation and attestation | Entities that a TLPT authority has identified | Duty | tlpt | No | A TLPT authority has not identified the entity | ||
| RQ-39 | RT | Article 27 | Testers for TLPT | Entities that a TLPT authority has identified | Duty | tlpt | No | A TLPT authority has not identified the entity | ||
| RQ-40 | RT | Article 16(1)(g); Delegated Regulation 2024/1774 Article 36 | ICT security testing under the simplified framework | Entities under the simplified framework (Article 16) | Duty | simplified | No | For entities under the simplified framework: the entity follows Articles 5 to 15 | ||
| RQ-41 | TP | Article 28(1) | You stay responsible | Every financial entity in scope | Duty | all | Yes | |||
| RQ-42 | TP | Article 28(3); Implementing Regulation 2024/2956 | The register of information | Every financial entity in scope | Duty | all | Yes | |||
| RQ-43 | TP | Article 28(3), third to fifth subparagraphs | Report on the register and tell the authority first | Every financial entity in scope | Duty | all | Yes | |||
| RQ-44 | TP | Article 28(2); Delegated Regulation 2024/1773 | A third-party risk strategy and a policy | Entities under the full framework, other than microenterprises | Duty | The strategy and the policy are for entities other than microenterprises and other than the Article 16 entities (Article 28(2)). | fullNotMicro | Yes | ||
| RQ-45 | TP | Article 5(3) | A role to monitor the arrangements | Entities under the full framework, other than microenterprises | Duty | fullNotMicro | Yes | |||
| RQ-46 | TP | Article 28(4) to (6); Article 29(1) | Assess before you contract, then audit | Every financial entity in scope | Duty | all | Yes | |||
| RQ-47 | TP | Article 30(1), (2) | Contract terms for every arrangement | Every financial entity in scope | Duty | all | Yes | |||
| RQ-48 | TP | Article 30(3) | More terms for critical or important functions | Every financial entity in scope | Duty | A microenterprise and the provider may agree that audit and inspection rights are delegated to an independent third party the provider appoints (Article 30(3), last subparagraph). | all | Yes | ||
| RQ-49 | TP | Article 28(7), (8) | Exit plans and the right to end the contract | Every financial entity in scope | Duty | all | Yes | |||
| RQ-50 | TP | Article 29(2); Delegated Regulation 2025/532 | Subcontracting of critical or important services | Every financial entity in scope | Duty | all | Yes | |||
| RQ-51 | TP | Articles 31 and 28(3) | Know whether a provider is designated as critical | Every financial entity in scope | Duty | all | Yes | |||
| RQ-52 | IS | Article 45 | Information sharing (optional) | Every financial entity in scope | Option | all | Yes |
Decision Table
The tables the formulas read
Fixed tables, taken from the text of DORA Articles 2, 3(60), 16 and 26 as the pack's facts hold them. The formulas read them by name. Nothing on this sheet is yours to change.
Regimes
The five results a profile can have, in the facts' words.
| Key | Meaning |
|---|---|
| full | Full ICT risk management framework (DORA Articles 5 to 15) |
| simplified | Simplified ICT risk management framework (DORA Article 16) |
| outOfScope | Out of scope of DORA |
| supplier | Not a financial entity: a supplier to financial entities |
| notCovered | Not a financial entity, and no financial entity as a customer |
Kinds of financial entity (DORA Article 2(1))
Q1 offers these. A kind marked Yes in "Never micro" cannot be a microenterprise (Article 3(60)). The last column is the extra TLPT text for the kinds that Delegated Regulation 2025/1190 Article 2(2) names.
| ID | Kind of financial entity | Point | Never micro | Payment incidents (Art 23) | TLPT text where Article 2(2) of the TLPT Regulation names the kind |
|---|---|---|---|---|---|
| credit | Credit institution | a | No | Yes | Not required unless a TLPT authority identifies the entity (Article 26(8)). Delegated Regulation 2025/1190 Article 2(2) names global or other systemically important credit institutions, and credit institutions that are part of one; the authority may decide that the assessment does not justify TLPT. |
| payment | Payment institution (including an exempted payment institution) | b | No | Yes | Not required unless a TLPT authority identifies the entity (Article 26(8)). Delegated Regulation 2025/1190 Article 2(2) names payment institutions that exceeded EUR 150 billion of total value of payment transactions in each of the 2 calendar years before the assessment; the authority may decide that the assessment does not justify TLPT. |
| aisp | Account information service provider | c | No | Yes | |
| emoney | Electronic money institution (including an exempted one) | d | No | Yes | Not required unless a TLPT authority identifies the entity (Article 26(8)). Delegated Regulation 2025/1190 Article 2(2) names electronic money institutions that exceeded EUR 150 billion of payment transactions, or EUR 40 billion of outstanding electronic money, in each of the 2 calendar years before the assessment; the authority may decide that the assessment does not justify TLPT. |
| investment | Investment firm | e | No | No | |
| casp | Crypto-asset service provider, or issuer of asset-referenced tokens | f | No | No | |
| csd | Central securities depository | g | Yes | No | Not required unless a TLPT authority identifies the entity (Article 26(8)). Delegated Regulation 2025/1190 Article 2(2) names central securities depositories; the authority may decide that the assessment does not justify TLPT. |
| ccp | Central counterparty | h | Yes | No | Not required unless a TLPT authority identifies the entity (Article 26(8)). Delegated Regulation 2025/1190 Article 2(2) names central counterparties; the authority may decide that the assessment does not justify TLPT. |
| venue | Trading venue | i | Yes | No | Not required unless a TLPT authority identifies the entity (Article 26(8)). Delegated Regulation 2025/1190 Article 2(2) names trading venues above the market-share criteria of Article 2(2)(f); the authority may decide that the assessment does not justify TLPT. |
| tr | Trade repository | j | Yes | No | |
| aifm | Manager of alternative investment funds | k | No | No | |
| mancos | Management company | l | No | No | |
| drsp | Data reporting service provider | m | No | No | |
| insurer | Insurance or reinsurance undertaking | n | No | No | Not required unless a TLPT authority identifies the entity (Article 26(8)). Delegated Regulation 2025/1190 Article 2(2) names insurance and reinsurance undertakings above the premium, provisions and asset criteria of Article 2(2)(g); the authority may decide that the assessment does not justify TLPT. |
| intermediary | Insurance, reinsurance or ancillary insurance intermediary | o | No | No | |
| iorp | Institution for occupational retirement provision | p | No | No | |
| cra | Credit rating agency | q | No | No | |
| benchmark | Administrator of critical benchmarks | r | No | No | |
| crowdfunding | Crowdfunding service provider | s | No | No | |
| securitisation | Securitisation repository | t | No | No | |
| none | Not a financial entity | - | - | - |
Exclusions (DORA Article 2(3))
Q4 offers these. An exclusion applies only to the kinds of entity named, except where it says any.
| ID | Choice | Kinds it can apply to | |
|---|---|---|---|
| - | None | Any | |
| EX-a | EX-a: A manager of alternative investment funds as referred to in Article 3(2) of Directive 2011/61/EU | Manager of alternative investment funds | |
| EX-b | EX-b: An insurance or reinsurance undertaking as referred to in Article 4 of Directive 2009/138/EC | Insurance or reinsurance undertaking | |
| EX-c | EX-c: An institution for occupational retirement provision that operates pension schemes with not more than 15 members in total | Institution for occupational retirement provision | |
| EX-d | EX-d: A natural or legal person exempted under Articles 2 and 3 of Directive 2014/65/EU | Any | |
| EX-e | EX-e: An insurance, reinsurance or ancillary insurance intermediary that is a microenterprise or a small or medium-sized enterprise | Insurance, reinsurance or ancillary insurance intermediary | |
| EX-f | EX-f: A post office giro institution as referred to in Article 2(5), point (3), of Directive 2013/36/EU | Credit institution | |
Entities of the simplified framework (DORA Article 16(1))
Q5 offers these. Articles 5 to 15 do not apply to them.
| ID | Choice | Kinds it can apply to | |
|---|---|---|---|
| - | None | Any | |
| SF-a | SF-a: A small and non-interconnected investment firm (the conditions of Article 12(1) of Regulation (EU) 2019/2033; DORA Art 3(34)) | Investment firm | |
| SF-b | SF-b: A payment institution exempted under Article 32(1) of Directive (EU) 2015/2366 | Payment institution (including an exempted payment institution) | |
| SF-c | SF-c: An institution exempted under Directive 2013/36/EU, where the Member State has decided not to use the option of DORA Article 2(4) | Credit institution | |
| SF-d | SF-d: An electronic money institution exempted under Article 9(1) of Directive 2009/110/EC | Electronic money institution (including an exempted one) | |
| SF-e | SF-e: A small institution for occupational retirement provision: one that operates pension schemes with fewer than 100 members in total | Institution for occupational retirement provision | |
Thresholds and periods
| Value | Used for |
|---|---|
| 10 | Staff: a microenterprise employs fewer than this many persons (Article 3(60)). |
| €2,000,000 | Euros: and its annual turnover or its annual balance sheet total does not exceed this (Article 3(60)). |
| 12 | Months between reviews of the scope assessment (DR-01). |
| 3 | Years between TLPTs for an entity that is identified, unless the authority changes the frequency (Article 26(1)). |
What the profile means for TLPT
| Situation | Text | ||||
|---|---|---|---|---|---|
| Full framework, not identified | Not required unless a TLPT authority identifies the entity (Article 26(8)). | ||||
| Simplified framework | Not required. DORA Article 26(1) leaves out the entities of Article 16(1). | ||||
| Outside DORA's scope, or a supplier | Not applicable. | ||||
| Microenterprise | Not required. DORA Article 26(1) leaves out microenterprises. | ||||
| Identified by a TLPT authority | Required. A TLPT authority has identified the entity: TLPT at least every 3 years, unless the authority changes the frequency (Article 26(1)). | ||||
Why a requirement does not apply
For each rule of the Requirements sheet, the reason shown for a No in each of the four situations of an entity in scope.
| Rule | Applies to | Full framework | Full framework, microenterprise | Simplified framework | Simplified framework, microenterprise |
|---|---|---|---|---|---|
| all | Every financial entity in scope | ||||
| full | Entities under the full framework (not the Article 16 entities) | For entities under the full framework: the entity follows Article 16 | For entities under the full framework: the entity follows Article 16 | For entities under the full framework: the entity follows Article 16 | For entities under the full framework: the entity follows Article 16 |
| fullNotMicro | Entities under the full framework, other than microenterprises | Not for microenterprises | Not for microenterprises | For entities under the full framework: the entity follows Article 16 | For entities under the full framework: the entity follows Article 16 |
| allNotMicro | Every financial entity in scope other than microenterprises | Not for microenterprises | Not for microenterprises | Not for microenterprises | Not for microenterprises |
| simplified | Entities under the simplified framework (Article 16) | For entities under the simplified framework: the entity follows Articles 5 to 15 | For entities under the simplified framework: the entity follows Articles 5 to 15 | For entities under the simplified framework: the entity follows Articles 5 to 15 | For entities under the simplified framework: the entity follows Articles 5 to 15 |
| micro | Microenterprises | For microenterprises only | For microenterprises only | For microenterprises only | For microenterprises only |
| tlpt | Entities that a TLPT authority has identified | A TLPT authority has not identified the entity | Article 26(1) excludes microenterprises | Article 26(1) excludes the entities of Article 16(1) | Article 26(1) excludes the entities of Article 16(1) |
Test Cases
21 typical cases run through the same formulas, each beside the regime, microenterprise status, TLPT identification and number of requirements the rules give it. Add a case of your own on a blank row.
| Case | Case description | Kind of entity (Q1) | Supplies ICT to a financial entity (Q2) | Designated critical (Q3) | Exclusion (Q4) | Simplified framework (Q5) | Member State excludes (Q6) | Staff (Q7) | Turnover (€) | Balance sheet (€) | Identified for TLPT (Q8) | Working: kind ID | Working: exclusion ID | Working: framework ID | Regime | Micro | TLPT identified | Requirements that apply | Expected regime | Expected micro | Expected TLPT | Expected requirements | Check |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TC-01 | payment institution, 64 staff (the EXAMPLE) | Payment institution (including an exempted payment institution) | None | None | 64 | €9,400,000 | €6,100,000 | No | payment | full | No | No | 41 | full | No | No | 41 | Agrees | |||||
| TC-02 | bank, large, identified for TLPT | Credit institution | None | None | 5,000 | €4,000,000,000 | €90,000,000,000 | Yes | credit | full | No | Yes | 44 | full | No | Yes | 44 | Agrees | |||||
| TC-03 | bank, large, not identified | Credit institution | None | None | 5,000 | €4,000,000,000 | €90,000,000,000 | No | credit | full | No | No | 41 | full | No | No | 41 | Agrees | |||||
| TC-04 | investment firm, 8 staff, EUR 1.5m turnover, a microenterprise | Investment firm | None | None | 8 | €1,500,000 | €9,000,000 | No | investment | full | Yes | No | 34 | full | Yes | No | 34 | Agrees | |||||
| TC-05 | investment firm, 9 staff, EUR 3m turnover and EUR 3m balance sheet, not micro | Investment firm | None | None | 9 | €3,000,000 | €3,000,000 | No | investment | full | No | No | 40 | full | No | No | 40 | Agrees | |||||
| TC-06 | investment firm, 10 staff, EUR 1m turnover, not micro | Investment firm | None | None | 10 | €1,000,000 | €1,000,000 | No | investment | full | No | No | 40 | full | No | No | 40 | Agrees | |||||
| TC-07 | small and non-interconnected investment firm | Investment firm | None | SF-a: A small and non-interconnected investment firm (the conditions of Article 12(1) of Regulation (EU) 2019/2033; DORA Art 3(34)) | 25 | €6,000,000 | €5,000,000 | No | investment | SF-a | simplified | No | No | 25 | simplified | No | No | 25 | Agrees | ||||
| TC-08 | exempted payment institution, 4 staff | Payment institution (including an exempted payment institution) | None | SF-b: A payment institution exempted under Article 32(1) of Directive (EU) 2015/2366 | 4 | €800,000 | €400,000 | No | payment | SF-b | simplified | Yes | No | 25 | simplified | Yes | No | 25 | Agrees | ||||
| TC-09 | exempted e-money institution, 40 staff | Electronic money institution (including an exempted one) | None | SF-d: An electronic money institution exempted under Article 9(1) of Directive 2009/110/EC | 40 | €5,000,000 | €5,000,000 | No | emoney | SF-d | simplified | No | No | 26 | simplified | No | No | 26 | Agrees | ||||
| TC-10 | trading venue with 6 staff is never a microenterprise | Trading venue | None | None | 6 | €1,000,000 | €1,000,000 | No | venue | full | No | No | 40 | full | No | No | 40 | Agrees | |||||
| TC-11 | CSD with 3 staff is never a microenterprise | Central securities depository | None | None | 3 | €1,000,000 | €1,000,000 | No | csd | full | No | No | 41 | full | No | No | 41 | Agrees | |||||
| TC-12 | insurer under Solvency II Article 4 is excluded | Insurance or reinsurance undertaking | EX-b: An insurance or reinsurance undertaking as referred to in Article 4 of Directive 2009/138/EC | None | 30 | No | insurer | EX-b | outOfScope | No | No | 0 | outOfScope | No | No | 0 | Agrees | ||||||
| TC-13 | pension institution with 12 members is excluded | Institution for occupational retirement provision | EX-c: An institution for occupational retirement provision that operates pension schemes with not more than 15 members in total | None | 2 | No | iorp | EX-c | outOfScope | No | No | 0 | outOfScope | No | No | 0 | Agrees | ||||||
| TC-14 | small pension institution with 80 members, simplified | Institution for occupational retirement provision | None | SF-e: A small institution for occupational retirement provision: one that operates pension schemes with fewer than 100 members in total | 4 | €1,000,000 | €1,000,000 | No | iorp | SF-e | simplified | Yes | No | 24 | simplified | Yes | No | 24 | Agrees | ||||
| TC-15 | CRD-exempted institution where the Member State excludes it | Credit institution | None | SF-c: An institution exempted under Directive 2013/36/EU, where the Member State has decided not to use the option of DORA Article 2(4) | Yes | 15 | No | credit | SF-c | outOfScope | No | No | 0 | outOfScope | No | No | 0 | Agrees | |||||
| TC-16 | CRD-exempted institution where the Member State does not exclude it | Credit institution | None | SF-c: An institution exempted under Directive 2013/36/EU, where the Member State has decided not to use the option of DORA Article 2(4) | No | 15 | €5,000,000 | €5,000,000 | No | credit | SF-c | simplified | No | No | 26 | simplified | No | No | 26 | Agrees | |||
| TC-17 | a microenterprise cannot be identified for TLPT | Payment institution (including an exempted payment institution) | None | None | 5 | €1,000,000 | €1,000,000 | Yes | payment | full | Yes | No | 35 | full | Yes | No | 35 | Agrees | |||||
| TC-18 | staff figure missing: not treated as micro | Investment firm | None | None | €100,000 | €100,000 | No | investment | full | No | No | 40 | full | No | No | 40 | Agrees | ||||||
| TC-19 | a supplier to a bank | Not a financial entity | Yes | No | supplier | No | No | 0 | supplier | No | No | 0 | Agrees | ||||||||||
| TC-20 | a designated critical supplier | Not a financial entity | Yes | Yes | supplier | No | No | 0 | supplier | No | No | 0 | Agrees | ||||||||||
| TC-21 | neither a financial entity nor a supplier to one | Not a financial entity | No | notCovered | No | No | 0 | notCovered | No | No | 0 | Agrees |
Lists
YesNo
Yes
No
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Financial entity | An entity of the kinds listed in Article 2(1), points (a) to (t), of DORA, such as a credit institution, a payment institution, an investment firm or an insurance undertaking. ICT third-party service providers are not financial entities. DORA binds financial entities, except those Article 2(3) excludes and those a Member State excludes under Article 2(4). |
| Microenterprise | A financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, that employs fewer than 10 persons and has an annual turnover or an annual balance sheet total that does not exceed EUR 2 million (DORA Art 3(60)). Several duties do not apply to a microenterprise, and the Regulation says where. |
| Full framework | The ICT risk management framework of DORA Articles 5 to 15, which applies to every financial entity that is not one of the Article 16 entities. Title II of Delegated Regulation (EU) 2024/1774 details it. |
| Simplified framework | The lighter ICT risk management framework of DORA Article 16 for small and non-interconnected investment firms, exempted payment institutions, exempted electronic money institutions, certain institutions exempted under Directive 2013/36/EU, and small institutions for occupational retirement provision. Articles 5 to 15 do not apply to them. Title III of Delegated Regulation (EU) 2024/1774 details it. |
| Supplier | In this pack, an organisation that provides ICT services to a financial entity. DORA reaches a supplier that is not itself a financial entity through the contract the financial entity must write (Article 30) and the information the financial entity must collect, and, if the ESAs designate it as critical, through oversight. A financial entity that sells ICT services to another financial entity follows this pack for its own duties and is a supplier to that customer, which writes the Article 30 terms into the contract with it. |
| TLPT | Threat-led penetration testing: a controlled, intelligence-led red team test of the entity's critical live production systems that copies real threat actors (DORA Art 3(17)). Only entities that a TLPT authority identifies perform it, and then at least every 3 years (Art 26). |
| Profile | The result of the scope assessment for one entity: its regime (the full framework, the simplified framework, out of scope, or supplier), whether it is a microenterprise, whether a TLPT authority has identified it, and the requirements that follow. |
| EXAMPLE | A worked example: a small authorised payment institution in an EU Member State, with 64 staff, as at 30 Sep 2026. Clear it before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.31 — Legal, statutory, regulatory and contractual requirements | The whole workbook: the legal requirements that apply to the entity, identified and recorded |
| NIST CSF 2.0 | GV.OC-03 — “Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed” | The whole workbook: the legal and regulatory requirements that apply to the entity, understood and recorded |
| DORA — Regulation (EU) 2022/2554 | Article 1(2) — for financial entities identified as essential or important entities under NIS2, DORA “shall be considered a sector-specific Union legal act for the purposes of Article 4” of NIS2 | Result sheet: how DORA relates to the directive on network and information security |
| DORA — Regulation (EU) 2022/2554 | Article 2(1) and (2) — applies to credit institutions; payment institutions, including exempted payment institutions; account information service providers; electronic money institutions, including exempted ones; investment firms; crypto-asset service providers and issuers of asset-referenced tokens; central securities depositories; central counterparties; trading venues; trade repositories; managers of alternative investment funds; management companies; data reporting service providers; insurance and reinsurance undertakings; insurance, reinsurance and ancillary insurance intermediaries; institutions for occupational retirement provision; credit rating agencies; administrators of critical benchmarks; crowdfunding service providers; securitisation repositories; and ICT third-party service providers. Points (a) to (t), which leave out the ICT third-party service providers, are collectively “financial entities” | Q1 and the Kinds table: the financial entities DORA binds |
| DORA — Regulation (EU) 2022/2554 | Article 2(3) — does not apply to managers of alternative investment funds as referred to in Article 3(2) of Directive 2011/61/EU; insurance and reinsurance undertakings as referred to in Article 4 of Directive 2009/138/EC; institutions for occupational retirement provision that operate pension schemes with not more than 15 members in total; persons exempted under Articles 2 and 3 of Directive 2014/65/EU; insurance, reinsurance and ancillary insurance intermediaries that are microenterprises or small or medium-sized enterprises; and post office giro institutions as referred to in Article 2(5), point (3), of Directive 2013/36/EU | Q4: the exclusions |
| DORA — Regulation (EU) 2022/2554 | Article 2(4) — Member States may exclude the entities referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU that are located in their territories; a Member State that does so informs the Commission, and of later changes, and the Commission makes the information public | Q6: the Member State option to exclude certain institutions |
| DORA — Regulation (EU) 2022/2554 | Article 3(34) — a “small and non-interconnected investment firm” is an investment firm that meets the conditions laid out in Article 12(1) of Regulation (EU) 2019/2033 | Q5: the small and non-interconnected investment firm |
| DORA — Regulation (EU) 2022/2554 | Article 3(60) — a “microenterprise” is a financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, “which employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million” | Q7 and the thresholds: the microenterprise test |
| DORA — Regulation (EU) 2022/2554 | Article 4 — financial entities implement the rules of Chapter II in line with proportionality, taking into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations; Chapters III, IV and V, Section I, apply proportionately “as specifically provided for in the relevant rules of those Chapters”; competent authorities consider how the entity applied proportionality when they review its ICT risk management framework on the reports submitted under Articles 6(5) and 16(2) | The whole workbook: the depth of each duty follows what the entity is |
| DORA — Regulation (EU) 2022/2554 | Article 16(1) — “Articles 5 to 15 of this Regulation shall not apply to” small and non-interconnected investment firms, exempted payment institutions, institutions exempted under Directive 2013/36/EU where the Member State has not applied the Article 2(4) option, exempted electronic money institutions, and small institutions for occupational retirement provision; those entities instead apply the simplified ICT risk management framework | Q5 and the Requirements sheet: the entities that follow the simplified framework |
| DORA — Regulation (EU) 2022/2554 | Article 16(2) — the simplified ICT risk management framework is documented and reviewed periodically and upon major ICT-related incidents in compliance with supervisory instructions, and “continuously improved on the basis of lessons derived from implementation and monitoring” | Requirements sheet, RQ-25: review of the simplified framework |
| DORA — Regulation (EU) 2022/2554 | Article 26(1) — financial entities, other than the entities of Article 16(1) first subparagraph and other than microenterprises, that the competent authority identifies under Article 26(8) carry out advanced testing by TLPT “at least every 3 years”; the authority may, on the entity’s risk profile and operational circumstances, ask it to reduce or increase that frequency | Q8 and the Result sheet: TLPT only for entities a TLPT authority identifies |
| DORA — Regulation (EU) 2022/2554 | Article 26(8) — financial entities contract testers under Article 27; where they use internal testers they contract external testers every three tests; competent authorities identify the entities required to perform TLPT on impact-related factors, possible financial stability concerns and the specific ICT risk profile, level of ICT maturity or technology features involved | Q8: identification by the competent authority |
| DORA — Regulation (EU) 2022/2554 | Article 28(2) — a strategy on ICT third-party risk, including a policy on ICT services supporting critical or important functions | Requirements sheet, RQ-44: the third-party strategy and its exceptions |
| DORA — Regulation (EU) 2022/2554 | Article 30(3)(f) — contracts for ICT services supporting critical or important functions include exit strategies, in particular a mandatory adequate transition period during which the provider continues the functions or services and that allows the financial entity to migrate to another provider or in-house; a microenterprise and the provider may agree that the entity’s audit and inspection rights are delegated to an independent third party appointed by the provider | Requirements sheet, RQ-48, and supplier term FD-07: exit strategies |
| DORA — Regulation (EU) 2022/2554 | Article 31(1) — the ESAs, through the Joint Committee and on the recommendation of the Oversight Forum, designate the ICT third-party service providers that are critical for financial entities and appoint a Lead Overseer for each | Q3 and the supplier path: designation of critical providers |
| DORA — Regulation (EU) 2022/2554 | Article 31(12) — financial entities may only use the services of an ICT third-party service provider established in a third country and designated as critical if it has established a subsidiary in the Union within 12 months of the designation | Supplier path, FD-10: the Union subsidiary of a designated third-country provider |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 1 — the ICT security policies, procedures, protocols and tools of Title II, and the simplified framework of Title III, take into account the entity’s size and overall risk profile and the nature, scale and elements of increased or reduced complexity of its services, activities and operations, including encryption and cryptography, ICT operations security, network security, ICT project and change management, and the potential impact of ICT risk on the confidentiality, integrity and availability of data and on the continuity of activities | Requirements sheet, RQ-02 and RQ-03: size and risk profile shape the measures |
| DORA — Delegated Regulation (EU) 2025/1190 | Article 2 — TLPT authorities assess whether a financial entity must perform TLPT on impact and systemic character (size, interconnectedness, criticality and substitutability of its services, complexity, group) and on ICT risk factors (risk profile, threat landscape, dependence on ICT, complexity of architecture, third-party arrangements, supervisory reviews, maturity of continuity plans and of detection and mitigation); they require TLPT, unless the assessment shows it is not justified, of credit institutions that are G-SIIs, O-SIIs or part of them, payment institutions that exceeded EUR 150 billion of total payment transactions in each of the 2 calendar years before the assessment, electronic money institutions above EUR 150 billion of payment transactions or EUR 40 billion of outstanding electronic money, central securities depositories, central counterparties, trading venues above set market-share criteria, and insurance and reinsurance undertakings above set premium, provisions and asset criteria | Q8 and the Kinds table: the kinds of entity the TLPT authorities assess |
| DORA — technical standard, cited by number and title only | Delegated Regulation (EU) 2024/1502, supplementing Regulation (EU) 2022/2554 by specifying the criteria for the designation of ICT third-party service providers as critical for financial entities (Official Journal, 30 May 2024) | Q3: the criteria for designating critical providers |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Regulation (EU) 2022/2554 (DORA); Delegated Regulations (EU) 2024/1772, 2024/1773, 2024/1774, 2025/301, 2025/532 and 2025/1190; Implementing Regulations (EU) 2024/2956 and 2025/302; as published in the Official Journal and read on 8 October 2026
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. They do not say that meeting one meets any DORA requirement.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.
The Delegated and Implementing Regulations bind the same financial entities as the Regulation they supplement, for the articles each applies to. Title II of Delegated Regulation (EU) 2024/1774 is for the entities that follow Articles 5 to 15; its Title III is for the entities of DORA Article 16(1). Delegated Regulation (EU) 2025/1190 binds only the entities that a TLPT authority identifies.