DORA Readiness Self-Assessment
Counts readiness across governance, ICT risk, incidents, testing and third-party risk, and names the blocking gaps. It gives no score.
Available soon
Answer it online instead: How ready are we for DORA?About 30 minutes, free, and nothing is stored.
- Format
- Excel
- Size
- 84 KB
- Length
- 11 sheets
- Version
- 1.3
- Updated
What's inside
What changed
- 1.3
The mappings note no longer says the CISO Times Library shows a verification state; it says what a mapping shows and to confirm it against both texts.
- 1.2
IM-01 and IM-02's "Operating when" no longer print an internal code name; they name the incident checks.
- 1.1
A financial entity that sells ICT services is also a supplier, and any Priority 1 gap goes to the chair route.
Earlier versions (1)
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Do this first: complete the DORA Proportionality & Scope Assessment. Enter its four answers on the Scope Profile sheet: the entity type, the framework, microenterprise status and TLPT identification. The workbook then marks each requirement and each item as applying or not, and says why not. Do not mark an item Not applicable yourself because it is hard or costly (DR-03). |
| 2 | On the Results sheet, enter the date of this assessment, the date of the next meeting of the management body and who rated the items. Assess at least every 6 months, and whenever the profile, the register or a critical or important contract changes (DR-18). |
| 3 | On the Assessment sheet, choose a readiness level for each item that applies. Read the 'Operating when' column first: an item is Operating only when it meets all of it and a supervisor could sample the records. When in doubt, choose the lower level. |
| 4 | Record the evidence you looked at, or the fact that decides the level. Open the document or the record; do not rely on what people say. |
| 5 | For every item below Operating, say what is missing, name one owner, and estimate the effort: Small, under [[2]] weeks of work, inside one team, within budget. Medium, [[2]] to [[8]] weeks, or two or more teams, within budget. Large, more than [[8]] weeks, or money the budget does not hold. Add a plan date if a plan already sets an earlier date than the latest one. The Check column prompts for anything missing. |
| 6 | Read the Results sheet: the result, the blocking gaps, the counts by area, and every gap in priority order. Take each blocking gap to the management body (DR-05). The sheet gives the date. Read the Sequence sheet to see where to work first (DR-02). |
| 7 | Copy every gap into the DORA Gap & Remediation Tracker, with its owner, effort and priority (DR-06). Keep a copy of each assessment: a supervisor may ask for it. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Limitations: This document helps you see what DORA asks of an entity like yours and what you can show. It is not legal advice, and following it is not a statement that you comply with DORA or any standard. Whether DORA binds you, and which of its duties apply to you, depends on what you are, how you are authorised and how your Member State and your supervisor apply it: confirm it with counsel or your competent authority.
What this workbook does not do. This workbook does not say which ISO/IEC 27001 controls or NIST CSF outcomes meet a DORA requirement. It gives each article's own words, what an entity must be able to show, and the CISO Times documents that help with the work. Where the CISO Times Library holds a mapping between a DORA requirement and a control, it shows it there with how closely the two match and where they differ; confirm it against both texts before relying on it. A document listed here helps with the work a requirement describes. Using it does not by itself show that the requirement is met.
The idea behind it. DORA is one regulation with five pillars: ICT risk management, ICT-related incident management and reporting, digital operational resilience testing, the management of ICT third-party risk, and information sharing. Every financial entity meets the same five pillars, and the depth of each depends on what the entity is. A microenterprise, a small investment firm, an exempted payment institution and a large bank each owe a different part of each pillar, and the Regulation says which. So the first question is what you are, the second is which duties that makes yours, and only then is it worth asking how ready you are. Being ready is a count of duties in place and duties still open. It is never one score.
The readiness levels:
Not started: Nothing exists yet.
Planned: Owner and approach agreed; not yet in place.
In place: Documented and working, but incomplete, short of its own target, or with too little record for a supervisor to sample.
Operating: Working in full and meeting its own target, with records a supervisor could sample.
Not applicable: The duty does not apply to the entity. The reason must be recorded, and confirmed with counsel. It counts neither for nor against the result.
Blocking gaps. A readiness item that is binding on this entity type (its requirements apply to the entity and are duties, not options) and is rated below In place. A blocking gap is a duty that is not in place at all. The Scope Profile sheet works out which items bind your entity. Every blocking gap is entered in the gap tracker as Priority 1 on the day it is found (DR-05).
The result. Not ready: at least one blocking gap, a binding duty rated below In place. Ready, with actions: no blocking gap, but some applicable items are below Operating. Ready: every applicable item is Operating, and each item that does not apply has its reason recorded. The result is one of three words with the counts beside it. It is never a score or a share. Until every item that applies has a level, the result reads Incomplete.
The rules this workbook applies: DR-03, DR-04, DR-05 ("A blocking gap is a readiness item that is binding on your entity type and is rated below In place. Every blocking gap is entered in the gap tracker as Priority 1 on the day it is found. It goes to the management body at its next meeting. If that meeting is more than [[10]] working days away, the DORA programme lead tells its chair within that time. Any other gap rated Priority 1 follows the same route, whatever its source.") and DR-06. The gap priorities and their days are in the Definitions sheet. The other rules are in the pack's documents.
EXAMPLE: Lantern Pay Services (EXAMPLE) is a small authorised payment institution in an EU Member State, with 64 staff, giving payment services for online merchants. DORA applied from 17 Jan 2025. Lantern Pay's board approved its scope assessment on 21 Nov 2024: a payment institution, authorised and not exempted, so under the full framework, and with 64 staff not a microenterprise. The board approved the ICT risk management framework and its yearly review report on 12 Mar 2026, and the ICT third-party strategy and policy on 10 Jun 2026. It submitted its register of information on 27 Mar 2026, in the format its authority set. The DORA programme lead ran the first readiness self-assessment as at 30 Sep 2026. 8 of 19 applicable items are below Operating, 2 of them blocking: the contract amendment for the payment platform, and its exit plan.
If you are a supplier to a financial entity. You are not a financial entity, so you do not run this assessment (DR-22). DORA lists ICT third-party service providers in Article 2(1), point (u), and defines financial entities as points (a) to (t) only. Its duties for the contract fall on the financial entity. A supplier is reached by DORA mainly through the terms its customers must ask for (the supplier flow-down list) and the information they must collect. A supplier designated as critical is also overseen by a Lead Overseer. Check your contracts against the 10 items of the flow-down list in the DORA Proportionality & Scope Assessment.
Adapting this template
Article 16 entity or microenterprise: choose the framework and microenterprise answer on the Scope Profile sheet. Items that do not apply drop out of the counts with their reason, and items that apply only to you appear.
Group: these sheets work at the level of one entity. A group keeps the register of information at sub-consolidated and consolidated level as well, and takes advice on that (DR-23).
National law or your authority's instructions: add each extra duty on the blank rows at the foot of the Assessment sheet, with an ID, an area and the requirement. A row you add counts as a binding duty that applies.
ICT run by a service provider: rate an item on what you can show, not on what the provider says. The owner is the person who manages the provider.
This workbook is your own record. Keep it with the evidence it rests on.
Scope Profile
Scope profile
Your four answers from the DORA Proportionality & Scope Assessment decide which requirements and items apply to you, which bind you, and why the others do not. Yellow cells are yours. The tables below calculate from them and read the facts of the pack (DR-01, DR-03).
Your profile
| Field | Your answer | Notes | |||
|---|---|---|---|---|---|
| Entity type (DORA Article 2(1)) | Payment institution (including an exempted payment institution) | The entity type from the scope assessment. DORA Article 2(1), points (a) to (t), lists them. EXAMPLE: Lantern Pay Services (EXAMPLE). | |||
| Framework | Full ICT risk management framework (DORA Articles 5 to 15) | The framework the scope assessment found: full (Articles 5 to 15) or simplified (Article 16). An entity that is out of scope, or is a supplier, does not use this workbook (DR-22). | |||
| Microenterprise (Article 3(60))? | No | Yes only if the scope assessment found a microenterprise (Article 3(60)). A central securities depository, central counterparty, trading venue or trade repository is never one, and the workbook ignores Yes for them. | |||
| Identified by a TLPT authority (Article 26)? | No | Yes only if a threat-led penetration testing authority has identified the entity. The workbook ignores Yes for an Article 16 entity or a microenterprise (Article 26(1)). | |||
| Scope assessment approved on | 21 Nov 2024 | The date the management body approved the scope assessment (DR-01). | |||
| Scope assessment last reviewed on | 4 Mar 2026 | The date of the latest review of the scope assessment (DR-01). | |||
| Your profile in one line | Payment institution (including an exempted payment institution); Full ICT risk management framework (DORA Articles 5 to 15) | ||||
| Check | OK | ||||
| Profile complete (working) | Yes |
| Entity type ID (working) | payment |
| Full framework (working) | 1 |
| Simplified framework (working) | 0 |
| Microenterprise (working) | 0 |
| TLPT authority has identified the entity (working) | 0 |
Each requirement, read from your profile
| Requirement | Article | Applies to | Duty or option | Applies to you? | Why it does not | Types (working) |
|---|---|---|---|---|---|---|
| RQ-01 Know whether DORA binds you | Article 2(1), (3), (4) | Every financial entity in scope | Duty | Yes | ||
| RQ-02 Apply the rules in proportion | Article 4 | Every financial entity in scope | Duty | Yes | ||
| RQ-03 Run the simplified framework | Article 16(1)(a) to (d); Delegated Regulation 2024/1774 Articles 29 to 38 | Entities under the simplified framework (Article 16) | Duty | No | For entities under the simplified framework: the entity follows Articles 5 to 15 | |
| RQ-04 The management body owns ICT risk | Article 5(1), (2) | Entities under the full framework (not the Article 16 entities) | Duty | Yes | ||
| RQ-05 Reporting channels to the management body | Article 5(2)(i) | Entities under the full framework (not the Article 16 entities) | Duty | Yes | ||
| RQ-06 Members keep their ICT knowledge current | Article 5(4) | Entities under the full framework (not the Article 16 entities) | Duty | Yes | ||
| RQ-07 A documented ICT risk management framework | Article 6(1) to (3) | Entities under the full framework (not the Article 16 entities) | Duty | Yes | ||
| RQ-08 Control function, three lines and ICT audit | Article 6(4), (6), (7) | Entities under the full framework, other than microenterprises | Duty | Yes | ||
| RQ-09 Review the framework every year and report on it | Article 6(5) | Entities under the full framework (not the Article 16 entities) | Duty | Yes | ||
| RQ-10 A digital operational resilience strategy | Article 6(8) | Entities under the full framework (not the Article 16 entities) | Duty | Yes | ||
| RQ-11 Reliable, resilient systems | Article 7 | Entities under the full framework (not the Article 16 entities) | Duty | Yes | ||
| RQ-12 Know your functions, assets and dependencies | Article 8(1), (2), (4) to (6) | Entities under the full framework (not the Article 16 entities) | Duty | Yes | ||
| RQ-13 Risk assessments on change and on legacy systems | Article 8(3), (7) | Entities under the full framework, other than microenterprises | Duty | Yes | ||
| RQ-14 Protection and prevention | Article 9 | Entities under the full framework (not the Article 16 entities) | Duty | Yes | ||
| RQ-15 Detection | Article 10 | Entities under the full framework (not the Article 16 entities) | Duty | Yes | ||
| RQ-16 Continuity policy, response and recovery plans | Article 11(1) to (5), (8) | Entities under the full framework (not the Article 16 entities) | Duty | Yes | ||
| RQ-17 Test the plans at least yearly | Article 11(6) | Entities under the full framework (not the Article 16 entities) | Duty | Yes | ||
| RQ-18 A crisis management function | Article 11(7) | Entities under the full framework, other than microenterprises | Duty | Yes | ||
| RQ-19 Backup, restoration and recovery | Article 12 | Entities under the full framework (not the Article 16 entities) | Duty | Yes | ||
| RQ-20 Learn from incidents and tests | Article 13(1) to (3), (5) | Entities under the full framework (not the Article 16 entities) | Duty | Yes | ||
| RQ-21 Awareness and resilience training for all staff | Article 13(6) | Entities under the full framework (not the Article 16 entities) | Duty | Yes | ||
| RQ-22 Crisis communication | Article 14 | Entities under the full framework (not the Article 16 entities) | Duty | Yes | ||
| RQ-23 Key dependencies and critical functions | Article 16(1)(e); Delegated Regulation 2024/1774 Article 30 | Entities under the simplified framework (Article 16) | Duty | No | For entities under the simplified framework: the entity follows Articles 5 to 15 | |
| RQ-24 Continuity, backup and restoration, and their tests | Article 16(1)(f), (g); Delegated Regulation 2024/1774 Articles 39 and 40 | Entities under the simplified framework (Article 16) | Duty | No | For entities under the simplified framework: the entity follows Articles 5 to 15 | |
| RQ-25 Lessons, training and the review report | Article 16(1)(h), 16(2); Delegated Regulation 2024/1774 Article 41 | Entities under the simplified framework (Article 16) | Duty | No | For entities under the simplified framework: the entity follows Articles 5 to 15 | |
| RQ-26 Governance under the simplified framework | Delegated Regulation 2024/1774 Article 28 | Entities under the simplified framework (Article 16) | Duty | No | For entities under the simplified framework: the entity follows Articles 5 to 15 | |
| RQ-27 An incident management process | Article 17 | Every financial entity in scope | Duty | Yes | ||
| RQ-28 Classify incidents by the criteria | Article 18; Delegated Regulation 2024/1772 | Every financial entity in scope | Duty | Yes | ||
| RQ-29 Report major incidents on time | Article 19(1), (3), (4) | Every financial entity in scope | Duty | Yes | ||
| RQ-30 Significant cyber threats (optional) | Article 19(2) | Every financial entity in scope | Option | Yes | ||
| RQ-31 Payment-related incidents | Article 23 | Every financial entity in scope; credit institution, payment institution (including an exempted payment institution), account information service provider, electronic money institution (including an exempted one) only | Duty | Yes | |credit|payment|aisp|emoney| | |
| RQ-32 A resilience testing programme | Article 24(1) to (5) | Every financial entity in scope other than microenterprises | Duty | Yes | ||
| RQ-33 Test the systems behind critical functions every year | Article 24(6) | Every financial entity in scope other than microenterprises | Duty | Yes | ||
| RQ-34 A range of tests | Article 25(1) | Every financial entity in scope | Duty | Yes | ||
| RQ-35 Microenterprises: risk-based testing | Article 25(3) | Microenterprises | Duty | No | For microenterprises only | |
| RQ-36 Vulnerability assessments before deployment | Article 25(2) | Every financial entity in scope; central securities depository, central counterparty only | Duty | No | For central securities depository, central counterparty only | |csd|ccp| |
| RQ-37 Threat-led penetration testing (if identified) | Article 26(1) to (3), (8) | Entities that a TLPT authority has identified | Duty | No | A TLPT authority has not identified the entity | |
| RQ-38 TLPT closure, remediation and attestation | Article 26(6), (7); Delegated Regulation 2025/1190 Articles 12 and 13 | Entities that a TLPT authority has identified | Duty | No | A TLPT authority has not identified the entity | |
| RQ-39 Testers for TLPT | Article 27 | Entities that a TLPT authority has identified | Duty | No | A TLPT authority has not identified the entity | |
| RQ-40 ICT security testing under the simplified framework | Article 16(1)(g); Delegated Regulation 2024/1774 Article 36 | Entities under the simplified framework (Article 16) | Duty | No | For entities under the simplified framework: the entity follows Articles 5 to 15 | |
| RQ-41 You stay responsible | Article 28(1) | Every financial entity in scope | Duty | Yes | ||
| RQ-42 The register of information | Article 28(3); Implementing Regulation 2024/2956 | Every financial entity in scope | Duty | Yes | ||
| RQ-43 Report on the register and tell the authority first | Article 28(3), third to fifth subparagraphs | Every financial entity in scope | Duty | Yes | ||
| RQ-44 A third-party risk strategy and a policy | Article 28(2); Delegated Regulation 2024/1773 | Entities under the full framework, other than microenterprises | Duty | Yes | ||
| RQ-45 A role to monitor the arrangements | Article 5(3) | Entities under the full framework, other than microenterprises | Duty | Yes | ||
| RQ-46 Assess before you contract, then audit | Article 28(4) to (6); Article 29(1) | Every financial entity in scope | Duty | Yes | ||
| RQ-47 Contract terms for every arrangement | Article 30(1), (2) | Every financial entity in scope | Duty | Yes | ||
| RQ-48 More terms for critical or important functions | Article 30(3) | Every financial entity in scope | Duty | Yes | ||
| RQ-49 Exit plans and the right to end the contract | Article 28(7), (8) | Every financial entity in scope | Duty | Yes | ||
| RQ-50 Subcontracting of critical or important services | Article 29(2); Delegated Regulation 2025/532 | Every financial entity in scope | Duty | Yes | ||
| RQ-51 Know whether a provider is designated as critical | Articles 31 and 28(3) | Every financial entity in scope | Duty | Yes | ||
| RQ-52 Information sharing (optional) | Article 45 | Every financial entity in scope | Option | Yes | ||
| A requirement that does not apply is never marked so because it is hard or costly. The reason comes from the text of the Regulation (DR-03). The requirement catalogue, with what each asks and what to show, is in the DORA Article-to-Control Mapping Library. | ||||||
Each readiness item, read from the requirements (working)
| Item | Applies to you? | Why it does not | Binding duty? | Reasons so far 1 | Reasons so far 2 | Reasons so far 3 | Reasons so far 4 | Reasons so far 5 |
|---|---|---|---|---|---|---|---|---|
| SC-01 | Yes | Yes | ||||||
| RM-01 | Yes | Yes | For entities under the simplified framework: the entity follows Articles 5 to 15 | |||||
| RM-02 | Yes | Yes | For entities under the simplified framework: the entity follows Articles 5 to 15 | For entities under the simplified framework: the entity follows Articles 5 to 15 | For entities under the simplified framework: the entity follows Articles 5 to 15 | For entities under the simplified framework: the entity follows Articles 5 to 15 | For entities under the simplified framework: the entity follows Articles 5 to 15 | |
| RM-03 | Yes | Yes | ||||||
| RM-04 | Yes | Yes | For entities under the simplified framework: the entity follows Articles 5 to 15 | |||||
| RM-05 | Yes | Yes | ||||||
| RM-06 | Yes | Yes | For entities under the simplified framework: the entity follows Articles 5 to 15 | |||||
| RM-07 | Yes | Yes | ||||||
| IM-01 | Yes | Yes | ||||||
| IM-02 | Yes | Yes | ||||||
| RT-01 | Yes | Yes | For microenterprises only | For microenterprises only; For central securities depository, central counterparty only | For microenterprises only; For central securities depository, central counterparty only; For entities under the simplified framework: the entity follows Articles 5 to 15 | |||
| RT-02 | Yes | Yes | ||||||
| RT-03 | No | A TLPT authority has not identified the entity | No | A TLPT authority has not identified the entity | A TLPT authority has not identified the entity | A TLPT authority has not identified the entity | ||
| TP-01 | Yes | Yes | ||||||
| TP-02 | Yes | Yes | ||||||
| TP-03 | Yes | Yes | ||||||
| TP-04 | Yes | Yes | ||||||
| TP-05 | Yes | Yes | ||||||
| IS-01 | Yes | No | ||||||
| SV-01 | Yes | No |
Assessment
One row per readiness item. Yellow columns are yours; the columns to the right of Plan date calculate. Rate each item that applies against its 'Operating when' column.
| Example | Item ID | Area | Readiness item | Requirements | DORA text | Operating when | Applies to you? | Binding duty? | Readiness level | Evidence and facts (reason, if not applicable) | What is missing (below Operating) | Gap owner (one role) | Effort | Plan date (if earlier than the latest) | Level counted | Blocking gap? | Gap priority | Latest due date | Due | Check | Why it does not apply | Order (working) | Blocking gaps so far (working) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | SC-01 | Scope and proportionality | Scope, profile and proportionality decided and recorded | RQ-01, RQ-02 | Article 2(1), (3), (4); Article 4 | The written assessment gives the entity type, any exclusion, the framework, microenterprise status and TLPT identification, each with its source. The management body approved it and counsel confirmed it, and it was reviewed in the last 12 months or since the last trigger (DR-01). | Yes | Yes | Operating | Scope assessment approved by the board on 21 Nov 2024 and reviewed on 4 Mar 2026; confirmed by counsel; no trigger since. | Operating | No | None | OK | |||||||||
| EXAMPLE | RM-01 | ICT risk management | The management body governs ICT risk | RQ-04, RQ-05, RQ-06, RQ-26 | Article 5(1), (2); Article 5(2)(i); Article 5(4); Delegated Regulation 2024/1774 Article 28 | Minutes show the management body approving the framework, strategy, risk tolerance, continuity plans, audit plans, third-party policy and budget (DR-07), regular reports reach it, and every member was trained in the last 12 months and every new member within 3 months. | Yes | Yes | In place | 4 of 5 members trained in the last 12 months; the member appointed on 15 Jul 2026 is booked for 8 Oct 2026, inside the 3 months. | Non-executive director 2, appointed on 15 Jul 2026, is not yet trained | The board | Small | 8 Oct 2026 | In place | No | Priority 2 | 29 Dec 2026 | 8 Oct 2026 | OK | 2005 | ||
| EXAMPLE | RM-02 | ICT risk management | The ICT risk management framework is documented, approved and reviewed | RQ-03, RQ-07, RQ-09, RQ-10, RQ-25 | Article 16(1)(a) to (d); Delegated Regulation 2024/1774 Articles 29 to 38; Article 6(1) to (3); Article 6(5); Article 6(8); Article 16(1)(h), 16(2); Delegated Regulation 2024/1774 Article 41 | The framework and the strategy are documented and approved, reviewed in the last 12 months and after each major incident, and the review report in the Regulation's format is ready for the authority. | Yes | Yes | Operating | Framework, strategy and risk tolerance approved by the board on 12 Mar 2026, with the review report in the Regulation's format. | Operating | No | None | OK | |||||||||
| EXAMPLE | RM-03 | ICT risk management | ICT risk control, independence and audit | RQ-08 | Article 6(4), (6), (7) | A control function oversees ICT risk with enough independence, the three lines are separate, the framework is internally audited on a plan, and critical audit findings are followed up. | Yes | Yes | Operating | The second-line risk function oversees ICT risk; internal audit reviewed the framework in 2025 and its critical finding was closed. | Operating | No | None | OK | |||||||||
| EXAMPLE | RM-04 | ICT risk management | Functions, assets and dependencies identified and assessed | RQ-12, RQ-13, RQ-23 | Article 8(1), (2), (4) to (6); Article 8(3), (7); Article 16(1)(e); Delegated Regulation 2024/1774 Article 30 | The inventories of functions, assets and dependencies are current and reviewed in the last 12 months, critical or important functions are marked, and risk assessments exist for each major change and each legacy system. | Yes | Yes | In place | Inventories are current and reviewed. The legacy back-office reporting server (SYS-06) has no ICT risk assessment in the last 12 months. | No ICT risk assessment in the last 12 months for the legacy reporting server (SYS-06) | Head of Information Security | Small | 13 Nov 2026 | In place | No | Priority 2 | 29 Dec 2026 | 13 Nov 2026 | OK | 2008 | ||
| EXAMPLE | RM-05 | ICT risk management | Protection, detection and resilient systems | RQ-11, RQ-14, RQ-15 | Article 7; Article 9; Article 10 | The information security policy and the access, authentication, change and patch policies operate with records, detection mechanisms and alert thresholds are defined and tested, and systems have the capacity they need. | Yes | Yes | Operating | Information security, access, authentication, change and patch policies operate with records; detection alerts are tested each quarter. | Operating | No | None | OK | |||||||||
| EXAMPLE | RM-06 | ICT risk management | Continuity, backup and recovery planned and tested | RQ-16, RQ-17, RQ-18, RQ-19, RQ-24 | Article 11(1) to (5), (8); Article 11(6); Article 11(7); Article 12; Article 16(1)(f), (g); Delegated Regulation 2024/1774 Articles 39 and 40 | The continuity policy, the plans and the business impact analysis are approved, the backup and restoration procedures are in use, and the plans were tested in the last 12 months with the deficiencies reported to the management body (DT-14). | Yes | Yes | In place | Continuity policy, plans and business impact analysis approved; the plan test for all functions was last run on 26 Aug 2025 and fell due on 26 Aug 2026. The crisis communication plan was tested on 24 Feb 2026. | The test of the continuity, response and recovery plans for all functions was last run on 26 Aug 2025 | Head of Information Security | Medium | 30 Oct 2026 | In place | No | Priority 2 | 29 Dec 2026 | 30 Oct 2026 | OK | 2010 | ||
| EXAMPLE | RM-07 | ICT risk management | Learning, training and crisis communication | RQ-20, RQ-21, RQ-22 | Article 13(1) to (3), (5); Article 13(6); Article 14 | Post-incident reviews and test lessons feed the risk assessment, all staff have completed the compulsory training, and a crisis communication plan names the person who speaks for the entity. | Yes | Yes | Operating | Post-incident reviews feed the risk register; all staff completed the compulsory module; a named person speaks for the entity in a crisis. | Operating | No | None | OK | |||||||||
| EXAMPLE | IM-01 | ICT-related incident management, classification and reporting | Incidents managed, logged and classified | RQ-27, RQ-28 | Article 17; Article 18; Delegated Regulation 2024/1772 | Every ICT-related incident and significant cyber threat is logged with its root cause, and every incident is classified against the criteria with the result recorded (incident checks IC-01 and IC-02). | Yes | Yes | Operating | Every incident is logged and classified against the criteria; the Q3 log has no major incident. | Operating | No | None | OK | |||||||||
| EXAMPLE | IM-02 | ICT-related incident management, classification and reporting | Major incidents can be reported on time | RQ-29, RQ-31 | Article 19(1), (3), (4); Article 23 | Authority, channel, templates, signatories and the client notice are ready, access was tested in the last 12 months, and reporting was rehearsed (incident checks IC-03 to IC-08; P18). | Yes | Yes | In place | Authority, channel, templates and signatories are ready (P18). The signatories' access to the authority's channel was last tested on 2025-08-12, more than 12 months ago. | The signatories' access to the authority's reporting channel was last tested on 12 Aug 2025 | Information Security Manager | Small | 16 Oct 2026 | In place | No | Priority 2 | 29 Dec 2026 | 16 Oct 2026 | OK | 2013 | ||
| EXAMPLE | RT-01 | Digital operational resilience testing | A risk-based resilience testing programme | RQ-32, RQ-34, RQ-35, RQ-36, RQ-40 | Article 24(1) to (5); Article 25(1); Article 25(3); Article 25(2); Article 16(1)(g); Delegated Regulation 2024/1774 Article 36 | The programme is approved, covers a range of tests chosen on risk, uses independent testers, and has a procedure to prioritise, classify and remedy findings and to confirm closure. | Yes | Yes | Operating | The programme was approved on 2026-01-28, uses independent testers and has a finding register with validated closure. | Operating | No | None | OK | |||||||||
| EXAMPLE | RT-02 | Digital operational resilience testing | Systems behind critical or important functions tested every 12 months | RQ-33 | Article 24(6) | Every system and application that supports a critical or important function has a counting test within the last 12 months (DR-12). | Yes | Yes | In place | 4 of 5 systems behind the critical function have a counting test in the last 12 months; SYS-02 fell due on 29 Aug 2026. | The settlement API gateway (SYS-02) was last tested on 29 Aug 2025 | Security Assurance Lead | Small | 23 Oct 2026 | In place | No | Priority 2 | 29 Dec 2026 | 23 Oct 2026 | OK | 2015 | ||
| EXAMPLE | RT-03 | Digital operational resilience testing | Threat-led penetration testing, if the entity is identified | RQ-37, RQ-38, RQ-39 | Article 26(1) to (3), (8); Article 26(6), (7); Delegated Regulation 2025/1190 Articles 12 and 13; Article 27 | The TLPT authority's identification, the validated scope, the testers' qualifications, the summary report, the remediation plans and the attestation are on file (DR-16). | No | No | Not applicable | A TLPT authority has not identified the entity | Not applicable | No | None | OK | A TLPT authority has not identified the entity | ||||||||
| EXAMPLE | TP-01 | Management of ICT third-party risk | The register of information is complete and valid | RQ-42, RQ-43 | Article 28(3); Implementing Regulation 2024/2956; Article 28(3), third to fifth subparagraphs | Every arrangement is in the register in the official templates, with no open data finding (RV-01 to RV-10), and the yearly report to the authority has been made in the form and by the date the authority set. | Yes | Yes | In place | 7 arrangements in the register, submitted on 27 Mar 2026; 1 open data finding (RV-03: the code of Hosting Subcontractor G). | The register has no LEI or EUID for Hosting Subcontractor G, behind CA-001 (RV-03) | Head of Procurement | Small | 23 Oct 2026 | In place | No | Priority 2 | 29 Dec 2026 | 23 Oct 2026 | OK | 2017 | ||
| EXAMPLE | TP-02 | Management of ICT third-party risk | Third-party strategy, policy and monitoring role | RQ-41, RQ-44, RQ-45 | Article 28(1); Article 28(2); Delegated Regulation 2024/1773; Article 5(3) | The strategy and the policy are approved by the management body in the last 12 months, and a role or senior manager monitors the arrangements and reports to the management body. | Yes | Yes | Operating | Strategy and policy approved by the board on 10 Jun 2026; the Head of Procurement is the designated manager. | Operating | No | None | OK | |||||||||
| EXAMPLE | TP-03 | Management of ICT third-party risk | Assessment before contracting, audit and concentration | RQ-46, RQ-51 | Article 28(4) to (6); Article 29(1); Articles 31 and 28(3) | Each critical or important arrangement has a pre-contract assessment with due diligence and concentration risk, an audit plan set on risk, and a check of the provider against the ESAs' list. | Yes | Yes | Operating | The pre-contract assessment and concentration check for CA-001 are on file; the provider was checked against the ESAs' list on 2026-09-21. | Operating | No | None | OK | |||||||||
| EXAMPLE | TP-04 | Management of ICT third-party risk | Contract terms in place | RQ-47, RQ-48 | Article 30(1), (2); Article 30(3) | Every contract has the Article 30(1) and (2) terms, and every contract for a critical or important function also has the Article 30(3) terms, including audit and access rights and participation in TLPT. | Yes | Yes | Planned | CA-001, signed in 2022, lacks the unrestricted audit and access wording and the TLPT participation term of Article 30(3). An amendment was drafted on 2026-09-12 and is not signed. | The CA-001 contract lacks the Article 30(3) audit, access and TLPT terms | General Counsel | Medium | Planned | Yes | Priority 1 | 30 Oct 2026 | 30 Oct 2026 | OK | 1020 | TP-04 | ||
| EXAMPLE | TP-05 | Management of ICT third-party risk | Exit plans and subcontracting for critical or important arrangements | RQ-49, RQ-50 | Article 28(7), (8); Article 29(2); Delegated Regulation 2025/532 | Each such arrangement has an exit plan reviewed and tested in the last 12 months (DR-17), termination rights, and a subcontracting assessment with the conditions in the contract. | Yes | Yes | Planned | CA-001 has no exit plan (B_07.01.0080 is No). The approach is agreed; the plan is not written. Hosting Subcontractor G has no LEI yet. | No exit plan for CA-001, the one arrangement behind the critical function | Head of Procurement | Large | Planned | Yes | Priority 1 | 30 Oct 2026 | 30 Oct 2026 | OK | 1021 | TP-04, TP-05 | ||
| EXAMPLE | IS-01 | Information sharing | Information sharing and threat notification: a decision | RQ-52, RQ-30 | Article 45; Article 19(2) | The entity has decided whether to take part in a trusted information-sharing community and whether to notify significant cyber threats, and has recorded the decision and, if it takes part, told its authority. | Yes | No | Operating | The board decided on 10 Jun 2026 not to join an information-sharing community yet; the decision is recorded. Significant cyber threats are notified only on the incident manager's judgement (Article 19(2) is optional). | Operating | No | None | OK | TP-04, TP-05 | ||||||||
| EXAMPLE | SV-01 | Supervision | Evidence ready for the competent authority | Evidence checklist | Evidence checklist: every item that applies | Every evidence item that applies has an owner and is ready, or its gap is in the tracker, so any item can be produced within 5 working days (DR-19). | Yes | No | Operating | 25 of 33 evidence items ready; the 8 not fully ready are each behind a gap in the tracker. | Operating | No | None | OK | TP-04, TP-05 |
Results
Results
The result, the blocking gaps, readiness by area and every gap in priority order, calculated from the Assessment sheet. Only the yellow settings are yours. Every figure is a count with names (DR-04).
EXAMPLE: Lantern Pay Services (EXAMPLE). Clear the EXAMPLE column and the yellow answers to use your own.
Settings
| Date of this assessment | 30 Sep 2026 | EXAMPLE: the example assessment date. Due dates count from it (DR-06). | |
| Next meeting of the management body | 22 Oct 2026 | Used for DR-05. EXAMPLE: the next board meeting. | |
| Working days to tell the chair (DR-05) | 10 | The [[10]] in DR-05. | |
| Months to the next assessment (DR-18) | 6 | The [[6]] in DR-18. | |
| Assessed by (role) | EXAMPLE: Head of Compliance | The person who rated the items and checked the evidence. | |
The result
| Result | Not ready | Not ready: at least one blocking gap, a binding duty rated below In place. Ready, with actions: no blocking gap, but some applicable items are below Operating. Ready: every applicable item is Operating, and each item that does not apply has its reason recorded. The result is one of three words with the counts beside it. It is never a score or a share. | ||||||||
| In one line | Not ready: 2 blocking gaps (TP-04, TP-05); 6 other items below Operating, out of 19 that apply. | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Blocking gaps | 2 | TP-04, TP-05. Each is a Priority 1 gap: listed first below, with its effort. | ||||||||
| Tell the management body (DR-05) | To the chair by 2026-10-14: the next meeting, on 2026-10-22, is later than 10 working days. | |||||||||
| Next assessment due (DR-18) | 30 Mar 2027 | Or sooner, when the profile, the register or a critical or important contract changes. | ||||||||
Readiness by area
| Area | DORA | Items | Operating | In place | Planned | Not started | Not applicable | Not rated | Result: at Operating | Blocking gaps |
|---|---|---|---|---|---|---|---|---|---|---|
| Scope and proportionality | Articles 2, 4 and 16 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 1 of 1 at Operating | 0 |
| ICT risk management | Chapter II, Articles 5 to 16 | 7 | 4 | 3 | 0 | 0 | 0 | 0 | 4 of 7 at Operating | 0 |
| ICT-related incident management, classification and reporting | Chapter III, Articles 17 to 23 | 2 | 1 | 1 | 0 | 0 | 0 | 0 | 1 of 2 at Operating | 0 |
| Digital operational resilience testing | Chapter IV, Articles 24 to 27 | 3 | 1 | 1 | 0 | 0 | 1 | 0 | 1 of 2 at Operating | 0 |
| Management of ICT third-party risk | Chapter V, Section I, Articles 28 to 30 | 5 | 2 | 1 | 2 | 0 | 0 | 0 | 2 of 5 at Operating | 2 |
| Information sharing | Chapter VI, Article 45 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 1 of 1 at Operating | 0 |
| Supervision | Evidence for the competent authority | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 1 of 1 at Operating | 0 |
| All areas | 20 | 11 | 6 | 2 | 0 | 1 | 0 | 11 of 19 at Operating | 2 | |
| Read the counts, not a percentage. An item In place works but is incomplete, or has too little record to sample. An item without an Item ID is not counted. Not applicable items are left out of 'at Operating'. The Not applicable count includes the items your profile says do not apply. | ||||||||||
Effort to close the gaps
| Effort | Priority 1 (blocking) | Priority 2 | Priority 3 | All gaps | What it means | |||||
|---|---|---|---|---|---|---|---|---|---|---|
| Small | 0 | 5 | 0 | 5 | Under [[2]] weeks of work, inside one team, within budget. | |||||
| Medium | 1 | 1 | 0 | 2 | [[2]] to [[8]] weeks, or two or more teams, within budget. | |||||
| Large | 1 | 0 | 0 | 1 | More than [[8]] weeks, or money the budget does not hold. | |||||
| Not estimated | 0 | 0 | 0 | 0 | Enter the effort on the Assessment sheet. | |||||
| All gaps | 2 | 6 | 0 | 8 | ||||||
Every gap, in priority order (copy into the gap tracker)
| No. | Item ID | Readiness item | Priority | Level | What is missing | Owner | Effort | Due | Row | |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | TP-04 | Contract terms in place | Priority 1, blocking | Planned | The CA-001 contract lacks the Article 30(3) audit, access and TLPT terms | General Counsel | Medium | 30 Oct 2026 | 17 | |
| 2 | TP-05 | Exit plans and subcontracting for critical or important arrangements | Priority 1, blocking | Planned | No exit plan for CA-001, the one arrangement behind the critical function | Head of Procurement | Large | 30 Oct 2026 | 18 | |
| 3 | RM-01 | The management body governs ICT risk | Priority 2 | In place | Non-executive director 2, appointed on 15 Jul 2026, is not yet trained | The board | Small | 8 Oct 2026 | 2 | |
| 4 | RM-04 | Functions, assets and dependencies identified and assessed | Priority 2 | In place | No ICT risk assessment in the last 12 months for the legacy reporting server (SYS-06) | Head of Information Security | Small | 13 Nov 2026 | 5 | |
| 5 | RM-06 | Continuity, backup and recovery planned and tested | Priority 2 | In place | The test of the continuity, response and recovery plans for all functions was last run on 26 Aug 2025 | Head of Information Security | Medium | 30 Oct 2026 | 7 | |
| 6 | IM-02 | Major incidents can be reported on time | Priority 2 | In place | The signatories' access to the authority's reporting channel was last tested on 12 Aug 2025 | Information Security Manager | Small | 16 Oct 2026 | 10 | |
| 7 | RT-02 | Systems behind critical or important functions tested every 12 months | Priority 2 | In place | The settlement API gateway (SYS-02) was last tested on 29 Aug 2025 | Security Assurance Lead | Small | 23 Oct 2026 | 12 | |
| 8 | TP-01 | The register of information is complete and valid | Priority 2 | In place | The register has no LEI or EUID for Hosting Subcontractor G, behind CA-001 (RV-03) | Head of Procurement | Small | 23 Oct 2026 | 14 | |
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
Order: Priority 1 first, then Priority 2, then Priority 3; within a priority, in the order of the Assessment sheet. The grey Row column is the item's position in the assessment table. The due date is the latest date for the priority, or an earlier plan date (DR-06). The gap tracker follows each gap to closure.
Limitations
This is a self-assessment. It is as good as the evidence behind each level. A second person checking the levels of the binding items is the best defence against optimism.
It reads the text of DORA and its technical standards as they stood on 8 October 2026. It is not legal advice, and it does not check what your Member State or your competent authority adds. Confirm the profile and any Not applicable item with counsel.
A level of Operating on every item that applies makes it likely, not certain, that a supervisor would find the duties in place. How proportionate each measure is for your entity is a judgement that your risk assessment supports. This workbook does not make it.
Effort is an estimate in bands. Use it to plan and to ask for resources, not as a commitment.
The result is one of three words with the counts beside it. Never turn the counts into a percentage, a score or a traffic-light total (DR-04).
Sequence
Where to work first
The order a smaller financial entity should work in (DR-02), with the readiness items each step settles and where you stand on them now. Counts only, calculated from the Assessment sheet.
| Step | What to do | Why it comes here | Rules | Items | Items at Operating, of those that apply | Blocking gaps |
|---|---|---|---|---|---|---|
| S-1 | Decide what you are | Every other duty depends on the answer, and the scope assessment is short. | DR-01, DR-03 | 1 of 1 at Operating | 0 | |
| S-2 | Put the management body in charge | DORA gives the management body the decisions and the responsibility, so the approvals in the later steps need it ready. | DR-07 | 0 of 1 at Operating | 0 | |
| S-3 | List what you depend on | The functions, the assets and the register of ICT arrangements come first. Provider identifiers take weeks to collect. | DR-08, DR-09, DR-10 | 0 of 2 at Operating | 0 | |
| S-4 | Write and approve the framework | It sets the risk tolerance, the continuity plans and the control functions that the tests and the contracts then use. | DR-07 | 4 of 5 at Operating | 0 | |
| S-5 | Close the gaps in critical or important arrangements | These are the duties a supervisor tests first: contract terms, exit plans and subcontracting. | DR-11, DR-17 | 2 of 4 at Operating | 2 | |
| S-6 | Make classification and reporting ready and rehearsed | A major incident starts a clock that does not wait for the programme. | DR-15 | 1 of 2 at Operating | 0 | |
| S-7 | Plan and run the tests | The yearly tests need the list of critical or important systems from step 3. | DR-12, DR-13, DR-14, DR-16 | 1 of 2 at Operating | 0 | |
| S-8 | Gather the evidence, review and report | Evidence is what is left to show once the work is done, and the cycle repeats. | DR-18, DR-19 | 2 of 2 at Operating | 0 |
The eight incident checks behind IM-01 and IM-02
| Check | What to be able to show | P18 checks | P18 rules | Reporting duties (P18) | |
|---|---|---|---|---|---|
| IC-01 | Every ICT-related incident is logged and classified against the criteria of Delegated Regulation 2024/1772, and the classification is recorded | RC-01 | RN-02, RN-03 | None | |
| IC-02 | The test for a major ICT-related incident is applied to each classification, and the result is recorded with the criteria met | RC-01 | RN-03 | RD-10 | |
| IC-03 | The competent authority, its channel and the templates for the initial notification, the intermediate report and the final report are known and ready | RC-04, RC-11 | RN-01, RN-07 | RD-10, RD-11, RD-12 | |
| IC-04 | Signatories and their deputies are named and have working access to the channel, tested in the last 12 months | RC-07, RC-08 | RN-08, RN-17 | None | |
| IC-05 | The reporting clocks are in the log and the calendars as soon as a report is made | RC-12 | RN-10 | RD-10, RD-11, RD-12 | |
| IC-06 | The notice to clients affected by a major incident is approved in advance | RC-13 | RN-14 | RD-13 | |
| IC-07 | Where a third party submits reports for the entity, the contract and its access are in place, and the entity stays responsible | RC-16 | RN-16 | None | |
| IC-08 | Classification and reporting were rehearsed in an exercise in the last 12 months (P10) | RC-17 | RN-17 | None | |
P09 owns incident response and every decision right, clock and recovery criterion. P18 holds the classification test and the reporting duties. This workbook states no reporting clock (DR-15). A check is a question to answer when you rate IM-01 and IM-02.
Lists
| Level | YesNo | Effort | AreaName | PriorityName | PriorityDays | EntityName | EntityId | EntityNoMicro | FrameworkChoice |
|---|---|---|---|---|---|---|---|---|---|
| Not started | Yes | Small | Scope and proportionality | Priority 1 | 30 | Credit institution | credit | 0 | Full ICT risk management framework (DORA Articles 5 to 15) |
| Planned | No | Medium | ICT risk management | Priority 2 | 90 | Payment institution (including an exempted payment institution) | payment | 0 | Simplified ICT risk management framework (DORA Article 16) |
| In place | Large | ICT-related incident management, classification and reporting | Priority 3 | 180 | Account information service provider | aisp | 0 | ||
| Operating | Digital operational resilience testing | Electronic money institution (including an exempted one) | emoney | 0 | |||||
| Not applicable | Management of ICT third-party risk | Investment firm | investment | 0 | |||||
| Information sharing | Crypto-asset service provider, or issuer of asset-referenced tokens | casp | 0 | ||||||
| Supervision | Central securities depository | csd | 1 | ||||||
| Central counterparty | ccp | 1 | |||||||
| Trading venue | venue | 1 | |||||||
| Trade repository | tr | 1 | |||||||
| Manager of alternative investment funds | aifm | 0 | |||||||
| Management company | mancos | 0 | |||||||
| Data reporting service provider | drsp | 0 | |||||||
| Insurance or reinsurance undertaking | insurer | 0 | |||||||
| Insurance, reinsurance or ancillary insurance intermediary | intermediary | 0 | |||||||
| Institution for occupational retirement provision | iorp | 0 | |||||||
| Credit rating agency | cra | 0 | |||||||
| Administrator of critical benchmarks | benchmark | 0 | |||||||
| Crowdfunding service provider | crowdfunding | 0 | |||||||
| Securitisation repository | securitisation | 0 |
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Readiness item | One of the readiness items, such as IM-01: a group of requirements that the readiness self-assessment rates in words (Not started, Planned, In place or Operating), never as a score. |
| Level: Not started | Nothing exists yet. |
| Level: Planned | Owner and approach agreed; not yet in place. |
| Level: In place | Documented and working, but incomplete, short of its own target, or with too little record for a supervisor to sample. |
| Level: Operating | Working in full and meeting its own target, with records a supervisor could sample. |
| Level: Not applicable | The duty does not apply to the entity. The reason must be recorded, and confirmed with counsel. Left out of the counts at Operating. |
| Binding duty | An item with at least one requirement that applies to your profile and is a duty, not an option. Below In place it is a blocking gap. |
| Blocking gap | A readiness item that is binding on this entity type (its requirements apply to the entity and are duties, not options) and is rated below In place. A blocking gap is a duty that is not in place at all. |
| Result | Not ready: at least one blocking gap, a binding duty rated below In place. Ready, with actions: no blocking gap, but some applicable items are below Operating. Ready: every applicable item is Operating, and each item that does not apply has its reason recorded. The result is one of three words with the counts beside it. It is never a score or a share. Incomplete: an item that applies has no level yet, or the profile is not complete. |
| Priority 1: Exposed now | A blocking gap: a duty that binds the entity is not in place at all. Due within 30 days of the assessment. |
| Priority 2: Exposed on request | A binding duty that is in place but not operating: a request for evidence of implementation would find it incomplete. Due within 90 days of the assessment. |
| Priority 3: Improvement | Any other item below Operating. Due within 180 days of the assessment. |
| Effort: Small | Under [[2]] weeks of work, inside one team, within budget. |
| Effort: Medium | [[2]] to [[8]] weeks, or two or more teams, within budget. |
| Effort: Large | More than [[8]] weeks, or money the budget does not hold. |
| Profile | The result of the scope assessment for one entity: its regime (the full framework, the simplified framework, out of scope, or supplier), whether it is a microenterprise, whether a TLPT authority has identified it, and the requirements that follow. |
| Management body | The body that effectively runs the entity or has key functions under the law that governs it, such as the board (DORA Art 3(30)). It defines, approves and oversees the ICT risk management arrangements and is ultimately responsible for ICT risk (Art 5). |
| TLPT | Threat-led penetration testing: a controlled, intelligence-led red team test of the entity's critical live production systems that copies real threat actors (DORA Art 3(17)). Only entities that a TLPT authority identifies perform it, and then at least every 3 years (Art 26). |
| DR-01 to DR-23 | The rules of this pack. DR-03 to DR-06 are quoted on the Instructions sheet. |
| RQ-xx, RI-xx, S-x, IC-xx | A requirement of the Regulation, a readiness item, a step of the readiness sequence, and an incident check. |
| EXAMPLE | A worked example: Lantern Pay Services (EXAMPLE), as at 30 Sep 2026. Clear the EXAMPLE column and the yellow answers before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 9.2 — Internal audit | The workbook as a whole: a planned check of readiness, with its results recorded |
| NIST CSF 2.0 | ID.IM-01 — “Improvements are identified from evaluations” | Results sheet: the gaps found, in priority order, for improvement |
| DORA — Regulation (EU) 2022/2554 | Article 4 — financial entities implement the rules of Chapter II in line with proportionality, taking into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations; Chapters III, IV and V, Section I, apply proportionately “as specifically provided for in the relevant rules of those Chapters”; competent authorities consider how the entity applied proportionality when they review its ICT risk management framework on the reports submitted under Articles 6(5) and 16(2) | Scope Profile sheet: each requirement applies in proportion to the entity, and the profile says which |
| DORA — Regulation (EU) 2022/2554 | Article 5(2) — the management body defines, approves, oversees and is responsible for the ICT risk management framework, bears ultimate responsibility for ICT risk and sets the risk tolerance | RM-01: the management body defines, approves and oversees the framework, and is responsible for it |
| DORA — Regulation (EU) 2022/2554 | Article 5(4) — members of the management body keep up to date with sufficient knowledge and skills to understand and assess ICT risk, including through regular training | RM-01: every member of the management body keeps ICT knowledge current, with training on a regular basis |
| DORA — Regulation (EU) 2022/2554 | Article 6(5) — the ICT risk management framework is documented and reviewed at least once a year (periodically for microenterprises), upon major ICT-related incidents, and following supervisory instructions or conclusions from digital operational resilience testing or audit processes; “It shall be continuously improved on the basis of lessons derived from implementation and monitoring.” A report on the review is submitted to the competent authority on request | RM-02: the framework is reviewed at least yearly (periodically for a microenterprise), and a report goes to the authority on request |
| DORA — Regulation (EU) 2022/2554 | Article 11(6) — test the ICT business continuity plans and the ICT response and recovery plans “in relation to ICT systems supporting all functions at least yearly, as well as in the event of any substantive changes to ICT systems supporting critical or important functions”, and test the crisis communication plans (Article 14); financial entities other than microenterprises include in the testing plans “scenarios of cyber-attacks and switchovers between the primary ICT infrastructure and the redundant capacity, backups and redundant facilities”; the policy and plans are regularly reviewed taking into account test results and recommendations from audit checks or supervisory reviews | RM-06: the continuity, response and recovery plans are tested at least yearly, and deficiencies reach the management body |
| DORA — Regulation (EU) 2022/2554 | Article 16(1) — “Articles 5 to 15 of this Regulation shall not apply to” small and non-interconnected investment firms, exempted payment institutions, institutions exempted under Directive 2013/36/EU where the Member State has not applied the Article 2(4) option, exempted electronic money institutions, and small institutions for occupational retirement provision; those entities instead apply the simplified ICT risk management framework | Scope Profile sheet: the Article 16 entities follow a simplified framework, and the items they rate change |
| DORA — Regulation (EU) 2022/2554 | Article 17(1) — define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents | IM-01: an incident management process that detects, manages, records and notifies ICT-related incidents |
| DORA — Regulation (EU) 2022/2554 | Article 19(1) — report major ICT-related incidents to the relevant competent authority | IM-02: major incidents reported with an initial notification, an intermediate report and a final report |
| DORA — Regulation (EU) 2022/2554 | Article 24(1) — “For the purpose of assessing preparedness for handling ICT-related incidents, of identifying weaknesses, deficiencies and gaps in digital operational resilience, and of promptly implementing corrective measures”, financial entities other than microenterprises establish, maintain and review a digital operational resilience testing programme | RT-01: a digital operational resilience testing programme as part of the framework |
| DORA — Regulation (EU) 2022/2554 | Article 24(6) — at least yearly, appropriate tests on all ICT systems and applications supporting critical or important functions | RT-02: every ICT system and application behind a critical or important function is tested at least yearly |
| DORA — Regulation (EU) 2022/2554 | Article 28(3) — a register of information on all contractual arrangements for ICT services, distinguishing those supporting critical or important functions | TP-01: the register of information on all contractual arrangements for ICT services |
| DORA — Regulation (EU) 2022/2554 | Article 28(8) — for ICT services supporting critical or important functions, financial entities put in place exit strategies that take account of provider failure, deteriorating quality, business disruption and termination; they must be able to exit without disruption to business activities, without limiting regulatory compliance and without detriment to the continuity and quality of services to clients; exit plans are comprehensive, documented and “sufficiently tested and reviewed periodically”, with alternative solutions, transition plans and contingency measures | TP-05: an exit plan for each arrangement that supports a critical or important function, tested and reviewed periodically |
| DORA — Regulation (EU) 2022/2554 | Article 30(3) — additional contract content for critical or important functions: full service levels, notice duties, contingency plans and security, testing participation, audit and access rights, exit strategies | TP-04: the additional contract terms for services that support critical or important functions |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 1 — the ICT security policies, procedures, protocols and tools of Title II, and the simplified framework of Title III, take into account the entity’s size and overall risk profile and the nature, scale and elements of increased or reduced complexity of its services, activities and operations, including encryption and cryptography, ICT operations security, network security, ICT project and change management, and the potential impact of ICT risk on the confidentiality, integrity and availability of data and on the continuity of activities | Scope Profile sheet and items RM-02 to RM-05: Delegated Regulation 2024/1774 applies the framework in proportion to the entity |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 40(1) — the entities under the simplified framework test their business continuity plans, including the scenarios referred to in Article 39, “at least once every year for the back-up and restore procedures, or upon every major change of the business continuity plan” | RM-06 for Article 16 entities: backup and restore procedures tested at least yearly, or on a major change to the plan |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Regulation (EU) 2022/2554 (DORA); Delegated Regulations (EU) 2024/1772, 2024/1773, 2024/1774, 2025/301, 2025/532 and 2025/1190; Implementing Regulations (EU) 2024/2956 and 2025/302; as published in the Official Journal and read on 8 October 2026
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. They do not say that meeting one meets any DORA requirement.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.
Regulation (EU) 2022/2554 binds the financial entities of its Article 2(1), points (a) to (t), except those Article 2(3) excludes and any that a Member State excludes under Article 2(4). Articles 5 to 15 do not apply to the entities of its Article 16(1), which follow Article 16 and Title III of Delegated Regulation (EU) 2024/1774. Several duties do not apply to microenterprises, and the Regulation says where. It reaches an ICT third-party service provider through the contract with a financial entity and, for a provider designated as critical, through the oversight framework of Chapter V, Section II.
The Delegated and Implementing Regulations bind the same financial entities as the Regulation they supplement, for the articles each applies to. Title II of Delegated Regulation (EU) 2024/1774 is for the entities that follow Articles 5 to 15; its Title III is for the entities of DORA Article 16(1). Delegated Regulation (EU) 2025/1190 binds only the entities that a TLPT authority identifies.
The competent authority for each financial entity is the one DORA Article 46 names for its type. National law and the authority's own instructions set the dates and channels for the register of information and for reports. None of them is stated here.