Does DORA apply to us?

How this is worked out, and what it is not

1. DORA is one regulation with five pillars: ICT risk management, ICT-related incident management and reporting, digital operational resilience testing, the management of ICT third-party risk, and information sharing. Every financial entity meets the same five pillars, and the depth of each depends on what the entity is. A microenterprise, a small investment firm, an exempted payment institution and a large bank each owe a different part of each pillar, and the Regulation says which. So the first question is what you are, the second is which duties that makes yours, and only then is it worth asking how ready you are. Being ready is a count of duties in place and duties still open. It is never one score.
2. Q1: choose what you are, or "Not a financial entity" if none of the 20 kinds fits. Q2 and Q3 then ask whether you supply ICT services to a financial entity and whether the European Supervisory Authorities have designated you as critical. A supplier does not run the readiness assessment (DR-22). It uses the supplier list in the result.
3. Q4 and Q5: read the exclusions of Article 2(3) and the entities of Article 16(1). Choose "None" only when none applies. Never choose either to lighten the work (DR-03). A choice that does not suit the kind of entity from Q1 is stopped.
4. Q6 appears only for an institution exempted under Directive 2013/36/EU. Answer it from your Member State's decision on the Article 2(4) option. Where your competent authority tells you something different, its view stands (DR-01).
5. Q7: give staff, turnover and balance sheet total. You choose a band for each figure, not the figure itself: the size test only compares each figure with these ceilings, so the band gives the same result and nothing more about your organisation is asked. A microenterprise has fewer than 10 staff and a turnover or balance sheet total of at most EUR 2 million. A central securities depository, a central counterparty, a trading venue and a trade repository are never microenterprises. A blank figure counts against being one.
6. Q8: answer Yes only if a TLPT authority has told you in writing that it identifies you. Never plan threat-led penetration testing before that (DR-16).

The result is a statement of what applies, in the workbook's words, never a score. The questions, the answers to choose from and the rule are the workbook's: the same answers give the same result in both. It is not legal advice.

• This document helps you see what DORA asks of an entity like yours and what you can show. It is not legal advice, and following it is not a statement that you comply with DORA or any standard. Whether DORA binds you, and which of its duties apply to you, depends on what you are, how you are authorised and how your Member State and your supervisor apply it: confirm it with counsel or your competent authority.
• Rule DR-01: "Decide what you are before anything else. Complete the scope assessment: the entity type (Article 2(1)), any exclusion (Article 2(3)), the simplified framework (Article 16(1)), whether you are a microenterprise (Article 3(60)) with the figures behind it, and whether a TLPT authority has identified you. The management body approves the assessment and counsel confirms it. Review it at least every 12 months, and whenever a figure, a licence or the Member State's use of Article 2(4) changes. Where your competent authority tells you something different, its view stands."
• Rule DR-21: "The competent authority, its channels, the dates and the format for the register and for reports, the language, and anything national law adds, are placeholders filled from your authority's own instructions. None is stated in this pack."
• If a directive on the security of network and information systems (NIS2) also covers you, DORA Article 1(2) treats DORA as a sector-specific Union act for the purposes of Article 4 of that directive. Ask counsel what that means for you.
• Regulation (EU) 2022/2554 binds the financial entities of its Article 2(1), points (a) to (t), except those Article 2(3) excludes and any that a Member State excludes under Article 2(4). Articles 5 to 15 do not apply to the entities of its Article 16(1), which follow Article 16 and Title III of Delegated Regulation (EU) 2024/1774. Several duties do not apply to microenterprises, and the Regulation says where. It reaches an ICT third-party service provider through the contract with a financial entity and, for a provider designated as critical, through the oversight framework of Chapter V, Section II.
• The competent authority for each financial entity is the one DORA Article 46 names for its type. National law and the authority's own instructions set the dates and channels for the register of information and for reports. None of them is stated here.