DORA Compliance Checklist: 60-Point Guide for Financial Services [2026]

Framework & Governance (12 items)

1. ICT risk management framework is documented, approved by management body, and reviewed annually
2. Management body has ultimate responsibility for ICT risk — formally assigned with board-level accountability
3. ICT risk management function is independent from ICT operations (separation of duties)
4. Digital operational resilience strategy is defined with clear objectives, risk appetite, and KRIs
5. ICT asset inventory is complete and current — all hardware, software, network components, cloud services
6. ICT systems and assets are classified by criticality and business function they support
7. Business impact analysis (BIA) completed for all critical ICT services and functions
8. Recovery time objectives (RTO) and recovery point objectives (RPO) defined for all critical systems
9. ICT risk appetite is quantified and formally approved by management body
10. Budget for ICT risk management and digital operational resilience is dedicated and adequate
11. Staff training programme covers ICT risk awareness for all employees, with specialised training for ICT staff
12. ICT risk management framework is proportionate to entity size, risk profile, and complexity

Pillar 1 Score: ___ / 24

Detection, Classification & Reporting (12 items)

13. ICT-related incident management process is documented with clear roles, escalation paths, and timelines
14. Incident classification criteria align with DORA's materiality thresholds (clients affected, transactions impacted, duration, geographic spread, data losses, critical services affected)
15. Major ICT incidents are reportable to competent authority — initial notification within 4 hours of classification
16. Intermediate report submitted within 72 hours of initial notification
17. Final report submitted within 1 month of the incident
18. Incident detection capabilities cover all critical ICT systems with automated alerting
19. Root cause analysis is performed for all major incidents with documented lessons learned
20. Incident response team is defined with clear RACI and on-call rotation
21. Communication plan covers internal stakeholders, competent authorities, and affected clients
22. Incident log maintained with full timeline, impact assessment, and remediation actions
23. Voluntary significant cyber threat reporting mechanism is established
24. Post-incident reviews feed back into ICT risk management framework updates

Pillar 2 Score: ___ / 24

Testing Programme (12 items)

25. ICT testing programme is documented with scope, frequency, and methodology for all critical systems
26. Vulnerability assessments performed at least annually on all critical ICT systems
27. Network security assessments conducted regularly
28. Open source software security analysis performed for all OSS components in critical systems
29. Gap analyses against relevant standards and frameworks performed annually
30. Physical security reviews of data centres and critical ICT infrastructure conducted
31. Source code reviews performed where applicable (custom-developed critical applications)
32. Scenario-based testing covers plausible but severe ICT disruption scenarios
33. Compatibility testing performed for new systems and major changes
34. Performance testing validates capacity under stress conditions
35. End-to-end testing covers critical business processes from user to back-end
36. Threat-led penetration testing (TLPT) performed at least every 3 years for significant entities (TIBER-EU or equivalent framework)

Pillar 3 Score: ___ / 24

Vendor Management (12 items)

37. Register of all ICT third-party service providers maintained and current
38. ICT third-party providers classified by criticality (supporting critical or important functions)
39. Due diligence performed before engaging ICT third-party providers
40. Contractual arrangements include all DORA-required clauses (SLAs, audit rights, exit strategies, data location, subcontracting approval, incident notification)
41. Concentration risk assessed — no excessive reliance on single provider or few providers
42. Exit strategies documented for all critical ICT service providers
43. Data location and processing requirements specified in contracts (EU/EEA or approved jurisdictions)
44. Right to audit ICT third-party providers is contractually guaranteed and exercised
45. Sub-outsourcing arrangements are subject to prior approval and documented
46. Incident notification requirements for ICT third-party providers are contractually defined
47. Business continuity plans address third-party service disruption scenarios
48. Annual review of ICT third-party risk exposure reported to management body

Pillar 4 Score: ___ / 24

Threat Intelligence (12 items)

49. Participation in at least one cyber threat information sharing arrangement
50. Information sharing agreements include safeguards for confidentiality and data protection
51. Threat intelligence is consumed and acted upon (not just received)
52. Indicators of compromise (IoCs) from sharing arrangements integrated into detection systems
53. Internal process exists for evaluating relevance of shared threat intelligence
54. Contributing threat intelligence back to sharing communities (not just consuming)
55. Management body informed of significant threat intelligence findings
56. Threat landscape assessment updated based on shared intelligence
57. Cross-sector threat intelligence considered (not just financial services)
58. Regulatory guidance on information sharing followed (ESMA/EBA/EIOPA publications)
59. Staff trained on information sharing protocols and confidentiality requirements
60. Effectiveness of threat intelligence sharing reviewed annually

Pillar 5 Score: ___ / 24

• 100-120: Fully compliant. Maintain and continuously improve.
• 80-99: Substantially compliant. Address remaining gaps as priority.
• 60-79: Partially compliant. Significant remediation needed — create a 90-day action plan.
• 40-59: Major gaps. Prioritise by pillar — start with Pillar 1 (framework) and Pillar 2 (incidents).
• 0-39: Not compliant. Requires immediate board-level attention and dedicated programme.

This checklist gives you a snapshot. For a deeper assessment with specific remediation recommendations, gap analysis against the RTS/ITS requirements, and a prioritised implementation roadmap, our DORA compliance assessment covers all 5 pillars in detail.