{ "id": "dora-checklist", "title": "DORA compliance checklist: 59 requirements by article", "description": "Core DORA requirements for financial entities with article references and the scope exemptions stated in the regulation.", "verified": "2026-10-19", "license": { "name": "CC BY 4.0", "url": "https://creativecommons.org/licenses/by/4.0/" }, "attribution": "ClevSec (https://clevsec.one)", "disclaimer": "For informational purposes only; not legal advice. Check the cited sources and your national law.", "human_readable": "https://clevsec.one/blog/dora-compliance-guide/?ref=agent", "sources": [ "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng", "https://eur-lex.europa.eu/eli/reg_del/2024/1772/oj/eng", "https://eur-lex.europa.eu/eli/reg_del/2025/301/oj/eng" ], "notes": "Entities listed in DORA Art. 16(1) apply Art. 16 and Title III of Delegated Regulation (EU) 2024/1774 instead of Arts. 5 to 15.", "items": [ { "section": "1. Governance (Article 5)", "requirement": "The management body defines, approves, oversees and is responsible for the ICT risk management framework.", "reference": "Art. 5(2)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "1. Governance (Article 5)", "requirement": "Clear roles and responsibilities are set for all ICT-related functions.", "reference": "Art. 5(2)(c)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "1. Governance (Article 5)", "requirement": "The management body sets and approves the digital operational resilience strategy, including the ICT risk tolerance level.", "reference": "Art. 5(2)(d)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "1. Governance (Article 5)", "requirement": "The management body approves and periodically reviews the ICT business continuity policy and the ICT response and recovery plans.", "reference": "Art. 5(2)(e)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "1. Governance (Article 5)", "requirement": "The management body approves and periodically reviews the ICT internal audit plans.", "reference": "Art. 5(2)(f)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "1. Governance (Article 5)", "requirement": "A budget for digital operational resilience, including security awareness and training, is allocated and reviewed.", "reference": "Art. 5(2)(g)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "1. Governance (Article 5)", "requirement": "The management body approves the policy on the use of ICT services from third-party providers, and has reporting channels on those arrangements and on major incidents.", "reference": "Art. 5(2)(h)–(i)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "1. Governance (Article 5)", "requirement": "A role monitors ICT third-party arrangements, or a member of senior management is designated for it.", "reference": "Art. 5(3)", "not_for_microenterprises": true, "not_for_simplified_framework_entities": false }, { "section": "1. Governance (Article 5)", "requirement": "Management body members follow regular training to understand and assess ICT risk.", "reference": "Art. 5(4)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "A documented ICT risk management framework covers strategies, policies, procedures, protocols and tools protecting all information and ICT assets, including premises and data centres.", "reference": "Art. 6(1)–(2)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "The framework is reviewed at least yearly (periodically for microenterprises), after major ICT-related incidents, and after supervisory, testing or audit findings.", "reference": "Art. 6(5)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "ICT risk is managed and overseen by a control function with appropriate independence (three lines of defence or an equivalent model).", "reference": "Art. 6(4)", "not_for_microenterprises": true, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "The framework is regularly audited by auditors with ICT expertise, and critical audit findings follow a formal remediation process.", "reference": "Art. 6(6)–(7)", "not_for_microenterprises": true, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "A digital operational resilience strategy sets the ICT risk tolerance, information security objectives with KPIs and risk metrics, and the ICT reference architecture.", "reference": "Art. 6(8)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "ICT-supported business functions, roles, information assets and ICT assets are identified, classified and documented, and reviewed at least yearly.", "reference": "Art. 8(1)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "An inventory of all information and ICT assets exists (including remote sites and network resources), critical assets are mapped, and so are their configurations and interdependencies.", "reference": "Art. 8(4), 8(6)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "All processes that depend on ICT third-party providers are documented.", "reference": "Art. 8(5)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "Sources of ICT risk, cyber threats and vulnerabilities are identified continuously; risk scenarios are reviewed at least yearly.", "reference": "Art. 8(2)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "A risk assessment is carried out on every major change to systems or processes, and on legacy ICT systems at least yearly.", "reference": "Art. 8(3), 8(7)", "not_for_microenterprises": true, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "A documented information security policy protects the availability, authenticity, integrity and confidentiality of data.", "reference": "Art. 9(4)(a)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "The network is managed so that connections can be severed or segmented instantly to stop contagion.", "reference": "Art. 9(4)(b)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "Physical and logical access is limited to what legitimate, approved functions require, with sound administration of access rights.", "reference": "Art. 9(4)(c)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "Strong authentication is in place, cryptographic keys are protected, and data is encrypted based on classification and risk assessment.", "reference": "Art. 9(4)(d)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "ICT changes are recorded, tested, assessed, approved, implemented and verified under a documented change management process.", "reference": "Art. 9(4)(e)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "Documented policies for patches and updates exist.", "reference": "Art. 9(4)(f)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "Detection mechanisms have alert thresholds and automatic alerts to incident response staff, and are regularly tested.", "reference": "Art. 10(1)–(2)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "An ICT business continuity policy and ICT response and recovery plans exist, based on a business impact analysis (BIA).", "reference": "Art. 11(1)–(3), 11(5)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "Business continuity and response and recovery plans are tested at least yearly and after substantive changes; crisis communication plans are tested.", "reference": "Art. 11(6)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "Continuity tests include cyber-attack scenarios and switchovers to redundant capacity, backups and facilities.", "reference": "Art. 11(6)", "not_for_microenterprises": true, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "A crisis management function exists to manage internal and external crisis communications.", "reference": "Art. 11(7)", "not_for_microenterprises": true, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "A backup policy sets the scope and minimum frequency of backups by criticality; restoration procedures exist and are tested periodically; restores on own systems use ICT systems segregated from the source.", "reference": "Art. 12(1)–(3)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "Recovery time and recovery point objectives are set for each function.", "reference": "Art. 12(6)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "Redundant ICT capacities are maintained (microenterprises assess whether they need them).", "reference": "Art. 12(4)", "not_for_microenterprises": true, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "Post-incident reviews follow every major ICT-related incident that disrupts core activities.", "reference": "Art. 13(2)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "Senior ICT staff report to the management body at least yearly on lessons learned and recommendations.", "reference": "Art. 13(5)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "ICT security awareness and digital operational resilience training are compulsory for all staff, including senior management.", "reference": "Art. 13(6)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "2. ICT risk management framework (Articles 6–14)", "requirement": "Crisis communication plans and communication policies exist, and at least one person handles public and media communication on incidents.", "reference": "Art. 14", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "3. Incident management and reporting (Articles 17–19)", "requirement": "An ICT-related incident management process is in place with early warning indicators, roles per incident type, escalation and communication plans.", "reference": "Art. 17(1), 17(3)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "3. Incident management and reporting (Articles 17–19)", "requirement": "All ICT-related incidents and significant cyber threats are recorded, and root causes are identified and addressed.", "reference": "Art. 17(2)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "3. Incident management and reporting (Articles 17–19)", "requirement": "Incidents are classified with the Article 18(1) criteria and the materiality thresholds of Delegated Regulation (EU) 2024/1772.", "reference": "Art. 18; RTS 2024/1772", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "3. Incident management and reporting (Articles 17–19)", "requirement": "Major incidents are reported to senior management, and the management body is informed of their impact, response and new controls.", "reference": "Art. 17(3)(e)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "3. Incident management and reporting (Articles 17–19)", "requirement": "Initial notification to the competent authority within 4 hours of classifying an incident as major, and no later than 24 hours after becoming aware of it (if classified as major later, within 4 hours of that classification).", "reference": "Art. 19(4); RTS 2025/301 Art. 5", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "3. Incident management and reporting (Articles 17–19)", "requirement": "Intermediate report within 72 hours of the initial notification; final report within one month of the latest intermediate report.", "reference": "Art. 19(4); RTS 2025/301 Art. 5", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "3. Incident management and reporting (Articles 17–19)", "requirement": "Clients are informed without undue delay when a major incident affects their financial interests.", "reference": "Art. 19(3)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "4. Digital operational resilience testing (Articles 24–26)", "requirement": "A risk-based digital operational resilience testing programme is established, maintained and reviewed.", "reference": "Art. 24(1), 24(3)", "not_for_microenterprises": true, "not_for_simplified_framework_entities": false }, { "section": "4. Digital operational resilience testing (Articles 24–26)", "requirement": "Tests are carried out by independent parties, internal or external, without conflicts of interest.", "reference": "Art. 24(4)", "not_for_microenterprises": true, "not_for_simplified_framework_entities": false }, { "section": "4. Digital operational resilience testing (Articles 24–26)", "requirement": "Procedures exist to prioritise, classify and fix all issues found in tests, and to validate the fixes.", "reference": "Art. 24(5)", "not_for_microenterprises": true, "not_for_simplified_framework_entities": false }, { "section": "4. Digital operational resilience testing (Articles 24–26)", "requirement": "All ICT systems and applications supporting critical or important functions are tested at least yearly.", "reference": "Art. 24(6)", "not_for_microenterprises": true, "not_for_simplified_framework_entities": false }, { "section": "4. Digital operational resilience testing (Articles 24–26)", "requirement": "Tests are chosen from the Article 25 range (vulnerability scans, network security assessments, scenario-based tests, penetration tests and others).", "reference": "Art. 25(1), 25(3)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "4. Digital operational resilience testing (Articles 24–26)", "requirement": "If the competent authority identifies the entity: threat-led penetration testing (TLPT) at least every 3 years.", "reference": "Art. 26(1)", "not_for_microenterprises": true, "not_for_simplified_framework_entities": true }, { "section": "5. ICT third-party risk (Articles 28–30)", "requirement": "A strategy on ICT third-party risk is adopted and reviewed, including a policy on ICT services supporting critical or important functions.", "reference": "Art. 28(2)", "not_for_microenterprises": true, "not_for_simplified_framework_entities": true }, { "section": "5. ICT third-party risk (Articles 28–30)", "requirement": "A register of information on all contractual arrangements for ICT services is maintained, using the templates of Implementing Regulation (EU) 2024/2956, distinguishing services that support critical or important functions.", "reference": "Art. 28(3); ITS 2024/2956", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "5. ICT third-party risk (Articles 28–30)", "requirement": "The competent authority receives a yearly report on new ICT arrangements, and is told in time about planned arrangements for critical or important functions.", "reference": "Art. 28(3)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "5. ICT third-party risk (Articles 28–30)", "requirement": "Before contracting: assess criticality, supervisory conditions, risks including concentration risk, due diligence on the provider, and conflicts of interest.", "reference": "Art. 28(4), 29", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "5. ICT third-party risk (Articles 28–30)", "requirement": "Contracts can be terminated in the Article 28(7) cases (significant breach, evidenced weaknesses, loss of supervisory access, and others).", "reference": "Art. 28(7)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "5. ICT third-party risk (Articles 28–30)", "requirement": "Exit strategies, and documented and tested exit plans, exist for ICT services supporting critical or important functions.", "reference": "Art. 28(8)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "5. ICT third-party risk (Articles 28–30)", "requirement": "Every ICT contract contains the Article 30(2) elements: service description, data and service locations, data protection, data return on exit, service levels, incident assistance, cooperation with authorities, termination rights, training participation.", "reference": "Art. 30(2)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "5. ICT third-party risk (Articles 28–30)", "requirement": "Contracts for critical or important functions also contain the Article 30(3) elements: precise service levels, notice duties, provider continuity plans and security, TLPT participation, unrestricted audit and access rights, and a mandatory exit transition period.", "reference": "Art. 30(3)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false }, { "section": "6. Information sharing (Article 45, voluntary)", "requirement": "If you join a cyber threat information-sharing arrangement, the competent authority is notified of your membership (and when it ends).", "reference": "Art. 45(3)", "not_for_microenterprises": false, "not_for_simplified_framework_entities": false } ] }