DORA Readiness Check
Ready for 17 January?
20 questions, 5 categories, 3 minutes. Find out how far your financial entity has come with the DORA requirements.
What DORA asks of financial entities
DORA is Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. It has applied since 17 January 2025 directly — unlike a directive it did not first have to be written into national law. The basic idea: a financial entity must stay able to operate even when its IT, or one of its providers, fails. The check above rates your maturity along the five pillars.
Who is affected?
DORA covers the financial sector very broadly — considerably more broadly than most people expect:
- Credit institutions, payment and e-money institutions
- Investment firms, trading venues, central securities depositories
- Insurance and reinsurance undertakings and their intermediaries
- Crypto-asset service providers, crowdfunding service providers, credit rating agencies
- Institutions for occupational retirement provision, managers of alternative investment funds
On top of that, critical ICT third-party providers can be placed under direct European supervision — something new for IT suppliers to the financial sector.
Proportionality applies: DORA does not ask the same of everyone. Scope and depth follow size, risk profile and complexity. For certain small entities the regulation explicitly provides for a simplified ICT risk management framework . So “we are too small for this” is not an argument — “we implement it proportionately” is.
The five pillars
| Pillar | What it covers |
|---|---|
| 1. ICT risk management | Governance framework, responsibility of the management body, protection and detection measures, backup, recovery, communication |
| 2. ICT incidents | Recording, classifying and reporting major ICT-related incidents to the supervisor — in stages |
| 3. Resilience testing | A regular testing programme; for certain institutions also threat-led penetration testing (TLPT) |
| 4. Third-party risk | Minimum contractual content, exit strategies and the register of information of all ICT providers |
| 5. Information sharing | Voluntary sharing of cyber threat information between financial entities |
The register of information catches most people out
In practice pillar 4 is the most common stumbling block. You have to keep a complete register of every contractual arrangement for ICT services — including which of them support critical or important functions . That register is filed with the supervisor. If you have never catalogued your providers systematically, this step alone takes several weeks.
How to read your result
The check rates your maturity per pillar and shows where the gaps are widest:
- Low maturity — governance and the register are missing. Start with the management body and with taking stock of your providers; everything else builds on that.
- Medium maturity — processes exist but are not documented or tested throughout. Typically: incidents get handled, but are not classified and reported the way DORA requires.
- High maturity — the framework is in place. What is left is usually the testing programme, exit strategies and keeping the register current.
The check is a self-assessment and is no substitute for regulatory advice.
The pragmatic route
If you already run an ISMS to ISO 27001 you have a considerable head start on DORA: risk management, supplier management, incident handling and business continuity are already in place. What you mainly need to add are the DORA-specific parts — the register of information, the reporting classification, the testing programme and the explicit responsibility of the management body.
Common questions about DORA
Since when has DORA applied?
Since 17 January 2025. As an EU regulation it applies directly in every member state — there was no additional national transposition period and no general transition phase.
Does DORA apply to small financial entities too?
Yes, but proportionately. For certain small and non-complex entities the regulation provides for a simplified ICT risk management framework. The duties do not fall away; their scope is reduced to what is appropriate.
Are we affected by DORA as an IT service provider?
Indirectly, certainly: your clients in the financial sector have to sign DORA-compliant contracts with you, enter you in their register of information and plan exit scenarios. If a provider is designated as critical, direct EU supervision comes on top.
Does DORA replace BAIT and VAIT?
As an EU regulation DORA takes precedence and largely covers the ground of the earlier German supervisory requirements for IT. The national rulebooks were adjusted accordingly. Today DORA is what counts.
What is a TLPT, and do we need one?
TLPT stands for threat-led penetration testing — a test driven by realistic attack scenarios. It is not mandatory for everyone, only for institutions that the supervisor designates on the basis of their significance.
Do we need ISO 27001 for DORA?
No, DORA does not require certification. An ISMS to ISO 27001 does cover a large part of the requirements, though, and is the most established way of demonstrating them in a structured form.
