DORA readiness checklist

DORA covers credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, insurers, fund managers and others. Exemptions in Art. 2(3) must also be checked.

The principle of proportionality allows lighter implementation, but competent authorities expect the reasoning to be written down and defensible.

Art. 16 applies to certain small and non-interconnected entities, such as small investment firms and exempted payment institutions. It replaces Art. 5 to 15 with lighter requirements.

This includes approving the digital operational resilience strategy, allocating budget and setting roles. Members must keep their ICT risk knowledge current through regular training (Art. 5(4)).

The framework covers strategies, policies, procedures, protocols and tools. Reviews should also follow supervisory findings and the results of resilience testing or audits.

Identify and classify business functions, roles and supporting assets, and map those that support critical or important functions. Update the inventory on every major change.

The aim is to ensure availability, authenticity, integrity and confidentiality of data. Detailed requirements are set out in the RTS on the ICT risk management framework.

Define alert thresholds and criteria that trigger incident response, and allocate enough resources to monitor user activity and anomalies.

Plans must cover critical or important functions, include a business impact analysis and crisis communication, and be tested for scenarios including switchover to redundant capacity.

Backups must be restorable from systems physically and logically segregated from the source. Set recovery time and recovery point objectives per function.

Also monitor technological developments and run ICT security awareness programmes and digital operational resilience training for all staff, including senior management.

Assign at least one person to handle the communication strategy for incidents and to act as spokesperson towards the public and media.

Record all ICT-related incidents and significant cyber threats, assign roles, set escalation paths and identify root causes to prevent recurrence.

Materiality thresholds that make an incident major are set in Delegated Regulation (EU) 2024/1772, adopted under Art. 18(3). Build them into your triage tooling.

Under Delegated Regulation (EU) 2025/301, Art. 5: initial notification within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it, intermediate report within 72 hours of the initial notification, final report within one month of the last intermediate report. Forms and templates are set in Implementing Regulation (EU) 2025/302.

Clients must also be told about measures taken to mitigate the adverse effects of the incident.

Notification of threats is voluntary, but a documented decision rule makes the practice consistent. Where applicable, inform potentially affected clients of protection measures they may take (Art. 19(3)).

Tests must be performed by independent internal or external parties, and identified weaknesses must be prioritised, classified and remedied.

Art. 25 lists suitable tests, such as vulnerability assessments, network security assessments, scenario-based tests, source code reviews and penetration tests.

TLPT covers critical or important functions on live production systems, may include ICT third-party service providers, and ends with an attestation from the authority.

Internal testers need competent authority approval and an external threat intelligence provider (Art. 27(2)). Entities using internal testers must contract external testers every three tests, and significant credit institutions may only use external testers (Art. 26(8)).

The management body reviews the risks identified for these arrangements. Third-party risk remains your responsibility even when services are outsourced.

Distinguish arrangements that support critical or important functions. Report at least yearly on new arrangements, provider categories, contract types and services, make the full register available on request, and inform the authority in a timely manner of planned arrangements for critical or important functions. The templates are set in Implementing Regulation (EU) 2024/2956.

Perform due diligence on the provider's suitability and check that supervisory conditions for contracting are met. Keep records of the assessment.

Exit plans must allow withdrawal without disrupting business, limiting compliance or degrading service quality, and should cover provider failure and contract termination.

Rights and obligations must be set out in writing, in one written document that includes the SLAs (Art. 30(1)). Review existing contracts against the list in Art. 30(2) and plan amendments where clauses are missing.

These include unrestricted access, inspection and audit rights for the entity and the competent authority, and the provider's participation in the entity's TLPT.

Critical providers are overseen by a Lead Overseer among the ESAs. Their recommendations can affect your arrangements, so track them in your third-party risk process.

Shared information can include indicators of compromise, tactics and techniques, and security alerts. Sharing must protect confidential data and respect competition and data protection rules.