Buyer guides for organizations that must comply with DORA or serve financial entities that do: scope, gap analysis, the register of information, incident reporting, TLPT, contracts, ICT providers, critical providers, cost, NIS2 and penalties.
How to tell whether DORA applies: the 20 types of financial entity in scope, the exclusions and member state options, how microenterprises and the simplified regime change the obligations, which entities must run TLPT, and how ICT providers are caught through contracts and oversight.
How to run a DORA gap analysis: the requirements to compare against (the Regulation plus its technical standards), the documents and recurring activities DORA names, frequencies set by the RTS, proportionality options, and the evidence supervisors can request.
What the DORA register of information is, who keeps it and at which levels, the 15 templates in Implementing Regulation (EU) 2024/2956, identifier and data quality rules, and the annual reporting cycle through competent authorities to the ESAs.
How DORA major incident reporting works: classification criteria and materiality thresholds, the three reports and their deadlines, templates and channels, outsourcing and aggregated reporting, client notification, payment incidents and the proposed single entry point.
What DORA threat-led penetration testing involves: who is selected, the three-year cycle, the phases and deadlines in Delegated Regulation (EU) 2025/1190, tester and threat intelligence provider requirements, pooled testing, the attestation, cost estimates and the link to TIBER-EU.
What DORA requires before, during and after contracting ICT services: the third-party risk strategy and policy, due diligence and concentration risk, mandatory contract clauses, subcontracting conditions, audit rights, the register and tested exit plans.
What DORA means for ICT providers serving EU financial entities: the contract terms customers must impose, audit and TLPT participation, subcontracting and identifier requests, incident assistance and reporting, and when a provider can be designated critical and overseen by the ESAs.
How the ESAs designate critical ICT third-party service providers, who is on the first list, what oversight involves (Lead Overseer, oversight plans, joint examination teams, recommendations), fees, periodic penalty payments, and what designation means for financial entity customers.
What DORA compliance costs and why it varies: the Commission impact assessment's figures, cost drivers named in the Regulation, TLPT cost estimates, oversight fees for critical providers, and the proportionality measures that reduce effort for smaller entities.
How DORA and the NIS2 Directive fit together for financial entities and their ICT providers: lex specialis rules, legal form and dates, incident reporting timelines, penalty regimes, information flows between authorities, and the proposed single reporting entry point.
What DORA says about penalties: the supervisory powers and minimum measures member states must give competent authorities, how penalty levels are set, criminal penalties and publication, periodic penalty payments for critical providers, and suspension of provider services.
The full set of DORA obligations in one place: the five areas of the Regulation, the delegated and implementing regulations that detail them, the documents and yearly activities they require, and how compliance is supervised without a certificate.
A working checklist built from the Regulation and its standards: the policies and plans to have, the registers and inventories to keep, the reviews and tests to run each year, incident reporting deadlines and the contract clauses every ICT agreement needs.
The dates that shaped DORA programmes: entry into force and application, when each technical standard was published, register of information deadlines, the first list of critical providers, the Commission review due in 2028 and the pending Digital Omnibus change.
Why no auditor can certify an entity as DORA compliant, what supervisors check instead, the review report and internal audit that serve as evidence, and the TLPT attestation, the only document an authority issues under DORA.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.