Tools · DORA ICT Risk & Resilience Readiness

How ready are we for DORA?

Say what kind of financial entity you are, then rate the 20 readiness items that DORA makes yours. You get the result in words, the blocking gaps, and every gap in priority order. It gives no score. Free, no account, and nothing is stored.

Part 1 of 8

About your organisation

These decide which questions apply to you.

Entity type (DORA Article 2(1))

The entity type from the scope assessment. DORA Article 2(1), points (a) to (t), lists them.

Framework

Full ICT risk management framework (DORA Articles 5 to 15) Simplified ICT risk management framework (DORA Article 16)

The framework the scope assessment found: full (Articles 5 to 15) or simplified (Article 16). An entity that is out of scope, or is a supplier, does not use this assessment (DR-22).

Microenterprise (Article 3(60))?

Yes No

Yes only if the scope assessment found a microenterprise (Article 3(60)). A central securities depository, central counterparty, trading venue or trade repository is never one, and this tool ignores Yes for them.

Identified by a TLPT authority (Article 26)?

Yes No

Yes only if a threat-led penetration testing authority has identified the entity. This tool ignores Yes for an Article 16 entity or a microenterprise (Article 26(1)).

You can move on with questions unanswered. They are left out, never counted against you. Nothing is saved, so reloading the page starts again.

About 30 minutes
Nothing is stored, not even in your browser: reloading starts again
Also as a workbook: DORA Readiness Self-Assessment

This one needs JavaScript

The questions are answered and the result worked out in your browser, so that nothing about your organisation is sent to us. Without JavaScript, the workbook version asks the same questions and reaches the same result.

How this is worked out, and what it is not

Blocking gaps. A readiness item that is binding on this entity type (its requirements apply to the entity and are duties, not options) and is rated below In place. A blocking gap is a duty that is not in place at all. Your answers about the organisation decide which items bind it. Every blocking gap is entered in the gap tracker as Priority 1 on the day it is found (DR-05).
The result. Not ready: at least one blocking gap, a binding duty rated below In place. Ready, with actions: no blocking gap, but some applicable items are below Operating. Ready: every applicable item is Operating, and each item that does not apply has its reason recorded. The result is one of three words with the counts beside it. It is never a score or a share. Until every item that applies has a level, the result reads Incomplete.
Priority 1 (Exposed now): A blocking gap: a duty that binds the entity is not in place at all. Close within 30 days of the assessment.
Priority 2 (Exposed on request): A binding duty that is in place but not operating: a request for evidence of implementation would find it incomplete. Close within 90 days of the assessment.
Priority 3 (Improvement): Any other item below Operating. Close within 180 days of the assessment.

Nothing here is scored out of 100 and there is no percentage. Results are in words and counts, and the questions, the levels and the rule are the workbook's: the same answers give the same result in both.

This is a self-assessment. It is as good as the evidence behind each level. A second person checking the levels of the binding items is the best defence against optimism.
It reads the text of DORA and its technical standards as they stood on 8 October 2026. It is not legal advice, and it does not check what your Member State or your competent authority adds. Confirm the profile and any Not applicable item with counsel.
A level of Operating on every item that applies makes it likely, not certain, that a supervisor would find the duties in place. How proportionate each measure is for your entity is a judgement that your risk assessment supports. This tool does not make it.
The result is one of three words with the counts beside it. Never turn the counts into a percentage, a score or a traffic-light total (DR-04).

From: DORA Readiness Self-Assessment, version 1.3
Questions: 20 readiness items · 7 areas