DORA · EU 2022/2554 · ICT Operational Resilience
DORA audit
for EU financial entities
EU Regulation 2022/2554 — five pillars: ICT risk management, ICT incident reporting, digital operational resilience testing, ICT third-party risk, and information sharing. Mandatory for banks, insurers, investment firms, e-money institutions, and crypto-asset service providers from January 2025.
ICT risk management framework
- Article 5 governance + management body responsibilities
- Article 6 ICT risk management framework
- Article 8 protection + prevention measures
- Article 9 detection + Article 11 response & recovery
ICT incident reporting
- Major incident classification (Art. 18)
- Initial / intermediate / final report workflow
- Significant cyber-threat reporting
- Cross-border reporting via competent authorities
Resilience testing programme
- Annual ICT resilience testing register
- Threat-led penetration testing (TLPT) for systemic firms
- Test-result evidence retention (3+ years)
- Remediation tracker with regulator visibility
ICT third-party register
- Article 28 register of contractual arrangements
- Critical TPP designation flag
- Concentration risk reporting
- Exit-strategy + sub-outsourcing chain tracking
DORA Regulatory Technical Standards (RTS) covered
Pre-seeded controls for the major RTS so your first DORA engagement starts at testable, not blank.
RTS on ICT risk management framework
RTS on classification of ICT incidents
RTS on threat-led penetration testing
RTS on policy on ICT services
RTS on register of information
ITS on incident reporting
Beat the DORA enforcement deadline
DORA pack seeded on the GRC Enterprise tier with TLPT register, ICT third-party register, and incident-classification workflow.