Skip to content

DORA Checklist

Regulation: EU 2022/2554 (Digital Operational Resilience Act) Deadline: 17.1.2025 (fully applicable) Scope: EU financial institutions (banks, insurers, investment firms, payment institutions)

About DORA

DORA is a lex specialis for the financial sector --- it replaces NIS2 requirements for ICT risk management, incident reporting and resilience testing in the financial sector.

Who falls under DORA?

Category	Examples
Credit institutions	Banks, savings banks
Payment institutions	Payment services, e-money
Investment firms	Securities dealers
Insurance undertakings	Life and non-life insurance
Reinsurance undertakings	Reinsurance companies
Pension funds	IORPs
Crypto-assets	Crypto-asset service providers (from MiCA)
ICT third parties	Critical ICT providers to the financial sector

Part E: DORA Compliance

#	Activity	Reference	Phase	Description
E1	Scope Determination	Art. 2	Preparation	Determine whether the organisation falls under DORA
E1.1	— Entity type	Art. 2(1)	Preparation	Bank, insurer, investment firm, payment institution?
E1.2	— Simplified regime?	Art. 16	Preparation	Do we qualify for the simplified regime?
E1.3	— Regulatory registration	Art. 2	Preparation	Registration/notification with the national authority
E2	GAP Analysis	Art. 4, 6	Analysis	Assessment of current state vs. DORA
E2.1	— Current state assessment	Art. 6	Analysis	Audit of current ICT risk management
E2.2	— Gap identification	Art. 6-15	Analysis	Identify gaps vs. DORA requirements
E2.3	— Remediation roadmap	Art. 6	Analysis	Remediation plan with priorities
E3	Governance Structure	Art. 5	Governance	Governance for ICT risk management
E3.1	— Board accountability	Art. 5(1)	Governance	Board fully responsible for ICT risk management
E3.2	— ICT risk management function	Art. 5(2)	Governance	Define ICT risk management function
E3.3	— Security committee	Art. 5	Governance	Security committee with regular reporting
E3.4	— Management training	Art. 5(4)	Governance	Management training in ICT risks
E4	ICT Risk Management Framework	Art. 6	Framework	Comprehensive ICT risk management framework
E4.1	— ICT risk management policy	Art. 6(1)	Framework	Documented ICT risk management policy
E4.2	— ICT risk management strategy	Art. 6(8)	Framework	Digital Operational Resilience Strategy
E4.3	— Risk tolerance	Art. 6(8)(b)	Framework	Risk tolerance definition for ICT risks
E4.4	— Framework review	Art. 6(5)	Framework	At least annual framework review
E5	ICT Asset Management	Art. 8	Identification	Identification and classification of ICT assets
E5.1	— ICT asset inventory	Art. 8(1)	Identification	Complete ICT asset inventory
E5.2	— Asset classification	Art. 8(1)	Identification	Classification by criticality
E5.3	— Business function mapping	Art. 8(2)	Identification	Mapping ICT to business functions
E5.4	— Dependencies mapping	Art. 8(3)	Identification	Mapping dependencies between systems
E6	ICT Risk Assessment	Art. 8	Risk	Regular ICT risk assessment
E6.1	— Risk identification	Art. 8(4)	Risk	Identify ICT risks
E6.2	— Risk analysis	Art. 8(4)	Risk	Analyse likelihood and impact
E6.3	— Risk treatment	Art. 8(4)	Risk	Risk treatment plan (mitigate/accept/transfer/avoid)
E6.4	— Risk reporting	Art. 8	Risk	Regular ICT risk reporting to the board
E7	Protection & Prevention	Art. 9, 10	Protection	Implementation of protective measures
E7.1	— ICT security policies	Art. 9(1)	Protection	ICT security policies
E7.2	— Network security	Art. 9(2)	Protection	Network security
E7.3	— Access control	Art. 9(3)	Protection	Access management, MFA, RBAC
E7.4	— Encryption	Art. 9(3)(b)	Protection	Data encryption at rest and in transit
E7.5	— Patch management	Art. 9(4)(c)	Protection	Patch management process
E7.6	— Data protection	Art. 10	Protection	Data and system protection
E8	Detection	Art. 10	Detection	Anomaly and incident detection
E8.1	— Monitoring capability	Art. 10(1)	Detection	Continuous ICT system monitoring
E8.2	— Anomaly detection	Art. 10(1)	Detection	Detection of anomalies and suspicious activities
E8.3	— SIEM implementation	Art. 10	Detection	SIEM for centralised monitoring
E9	Business Continuity	Art. 11, 12	Continuity	ICT Business Continuity Management
E9.1	— ICT BCP policy	Art. 11(1)	Continuity	ICT Business Continuity Policy
E9.2	— BIA (Business Impact Analysis)	Art. 11(3)	Continuity	Business impact analysis
E9.3	— Recovery plans	Art. 11(4)	Continuity	ICT response and recovery plans
E9.4	— Backup strategy	Art. 12(1)	Continuity	Backup and restore strategy
E9.5	— Recovery testing	Art. 12(2)	Continuity	Recovery testing (min. annually)
E9.6	— Crisis communication	Art. 11(5)	Continuity	Crisis communication
E10	Incident Management	Art. 17-19	Incident	ICT incident management process
E10.1	— Incident management policy	Art. 17(1)	Incident	ICT incident management policy
E10.2	— Incident classification	Art. 18	Incident	Incident severity classification
E10.3	— Incident response team	Art. 17	Incident	Incident Response Team (IRT)
E10.4	— Root cause analysis	Art. 17(3)	Incident	Post-incident analysis
E11	Incident Reporting	Art. 19	Reporting	ICT incident reporting
E11.1	— Major incident criteria	Art. 18(1)	Reporting	Major incident criteria
E11.2	— Initial notification	Art. 19(4)(a)	Reporting	Initial notification to authority
E11.3	— Intermediate report	Art. 19(4)(b)	Reporting	Intermediate report
E11.4	— Final report	Art. 19(4)(c)	Reporting	Final report (1 month)
E12	Resilience Testing	Art. 24, 25	Testing	Regular resilience testing
E12.1	— Testing programme	Art. 24(1)	Testing	Digital resilience testing programme
E12.2	— Vulnerability assessments	Art. 24(2)	Testing	Regular vulnerability scanning
E12.3	— Penetration testing	Art. 24(2)	Testing	Annual penetration tests
E12.4	— Scenario-based testing	Art. 24(2)	Testing	Scenario testing (DR, incident)
E13	TLPT (Advanced Testing)	Art. 26	TLPT	Threat-Led Penetration Testing
E13.1	— TLPT scope	Art. 26(1)	TLPT	Determine scope for TLPT (if required)
E13.2	— TLPT provider selection	Art. 26(4)	TLPT	Select certified TLPT provider
E13.3	— TLPT execution	Art. 26	TLPT	Execute TLPT
E14	Third-Party Risk	Art. 28-30	Third-Party	ICT third-party risk management
E14.1	— ICT third-party policy	Art. 28(1)	Third-Party	ICT third-party policy
E14.2	— Third-party register	Art. 28(3)	Third-Party	ICT third-party register
E14.3	— Due diligence	Art. 28(4)	Third-Party	Due diligence for ICT providers
E14.4	— Contractual requirements	Art. 30	Third-Party	Contractual requirements (DORA Art. 30)
E14.5	— Exit strategies	Art. 28(8)	Third-Party	Exit strategies for critical ICT providers
E15	Critical ICT Registry	Art. 28(3)	Registry	Registry of critical ICT third parties
E15.1	— Critical ICT identification	Art. 28(3)	Registry	Identify critical ICT providers
E15.2	— Registry submission to ESAs	Art. 28(3)	Registry	Submit register to ESAs (via national authority)
E15.3	— Registry updates	Art. 28(3)	Registry	Ongoing register updates
E16	Learning & Evolving	Art. 13	Continuous	Continuous improvement
E16.1	— Lessons learned	Art. 13(1)	Continuous	Lessons learned process from incidents
E16.2	— Post-incident reviews	Art. 13(2)	Continuous	Mandatory post-incident reviews
E16.3	— Threat intelligence	Art. 13	Continuous	Threat intelligence integration
E17	Communication	Art. 14	Communication	ICT communication protocols
E17.1	— Internal communication	Art. 14(1)	Communication	Internal communication during incidents
E17.2	— External communication	Art. 14(2)	Communication	External communication (clients, media)
E18	Regulatory Reporting	Art. 37-38	Reporting	Reporting to national authority and ESAs
E18.1	— Compliance reporting	Art. 37	Reporting	Regular compliance reporting
E18.2	— Audit cooperation	Art. 38	Reporting	Cooperation with auditors and regulators

Key DORA milestones

Date	Milestone
16.1.2023	DORA entered into force
17.1.2025	DORA fully applicable
30.4.2025	ICT third-party registries -> ESAs
July 2025	ESAs designate critical ICT providers
Every 3 years	TLPT for significant institutions

Relationship of DORA to other regulations

Critical path

E1 Scope Determination -> IMMEDIATELY (DORA already in effect)
E2 GAP Analysis -> by 28.2.2025
E3 Governance Structure -> by 28.2.2025
E4 ICT Risk Management Framework -> by 30.4.2025
E10-E11 Incident Management & Reporting -> by 30.4.2025
E14-E15 Third-Party Risk & Registry -> by 30.4.2025
E12 Resilience Testing Programme -> by 30.9.2025

Implementation phases

Sources