DORA COMPLIANCE CHECKLIST

Compliance checklist on a clipboard with regulation binders on a bank desk

Checklist: SUGGESTED REVIEW FREQUENCY

1. ICT RISK MANAGEMENT FRAMEWORK

  • Define roles and responsibilities for ICT risk (board, management, ICT, etc.)

  • Integrate ICT risk into your overall enterprise risk management

  • Maintain an up-to-date ICT risk register

  • Classify ICT systems based on criticality and business impact

  • Document all ICT assets, dependencies, and interconnections

  • Establish security baselines for systems and networks

  • Maintain secure software development practices

  • Document change management procedures for all ICT components

  • Implement patch management with defined timelines

  • Continuously monitor ICT threats and vulnerabilities

  • Define and classify ICT incidents (major, significant, minor)

  • Establish an ICT incident response plan

  • Implement 24/7 monitoring and detection capabilities

  • Record all ICT incidents in a centralized logbook

  • Conduct root cause analysis for major incidents

  • Notify regulators (e.g., national competent authority) within 4 hours of classifying a major incident

  • Communicate incidents to impacted customers or partners where relevant

  • Analyze trends and metrics to improve resilience

3. DIGITAL OPERATIONAL RESILIENCE TESTING

  • Develop a risk-based testing program (annual minimum)

  • Conduct vulnerability assessments and penetration testing

  • Test backup restoration processes regularly

  • Test incident response plans (tabletop and live exercises)

  • Carry out scenario-based testing for critical services

  • Conduct DORA TLPT at least every 3 years for critical ICT

  • Document test results and remedial actions

  • Report material gaps and mitigation plans to senior management

4. ICT THIRD-PARTY RISK MANAGEMENT

  • Maintain a register of all ICT third-party service providers

  • Categorize providers based on criticality

  • Assess and document third-party risks before onboarding

  • Ensure all contracts include:

    • Service levels and performance targets

    • Access rights for audits and inspections

    • Data security and location of processing

    • Exit and termination clauses

  • Monitor third-party performance and compliance continuously

  • Establish a third-party incident notification process

  • Ensure right to terminate in case of systemic risk or regulatory breach

  • Perform due diligence for fourth-party risks

5. INFORMATION SHARING ARRANGEMENTS

  • Participate in trusted information sharing groups (ISACs, NIS cooperation groups, etc.)

  • Define internal rules for how threat intel is shared internally and externally

  • Use shared intelligence to update risk models and detection capabilities

  • Ensure all information sharing complies with GDPR and competition law

6. GOVERNANCE & OVERSIGHT

  • Assign ultimate ICT risk responsibility to the board of directors

  • Review ICT risk and resilience metrics in regular board meetings

  • Ensure senior management oversees compliance with DORA

  • Conduct internal audits of ICT risk, incidents, and resilience

  • Train staff on DORA obligations and operational resilience

  • Include DORA compliance in annual internal control reports

For the leadership team, our board and executive DORA course at BlueTeam Academy provides practical exercises in ICT risk oversight and records course completion.

7. DOCUMENTATION & RECORDKEEPING

  • Maintain all relevant policies, procedures, and registers:

    • ICT risk management framework

    • Incident response and notification logs

    • Testing reports and remediation

    • Third-party contracts and assessments

  • Store records securely and make them available to regulators upon request

  • Keep documentation updated and reflect changes in organizational structure or ICT setup

8. ENTITY-SPECIFIC ACTIONS (IF APPLICABLE)

For critical or important ICT third-party service providers:

  • Prepare for potential designation by the European Supervisory Authorities (ESA)

  • Ensure readiness for direct oversight by the ESAs

  • Cooperate with audits, reporting, and onsite inspections by regulators

9. REPORTING & NOTIFICATION TIMELINES

Trigger Deadline Recipient
Major ICT Incident Within 4 hours National Competent Authority
Initial Impact Assessment Within 1 business day National Competent Authority
Final Report Within 1 month National Competent Authority
TLPT Results (if required) On completion National Competent Authority

SUGGESTED REVIEW FREQUENCY

Area Review Frequency
ICT Risk Framework Annually
Incident Response Plan Semi-annually
Third-Party Risk Register Quarterly
Resilience Testing Plan Annually
Board Reporting Quarterly
Staff Training Annually
Policy and Documentation Updates As needed

Download the DORA compliance checklist (CSV)

DORA COMPLIANCE CHECKLIST - key points
14 countries: Ready to get started? Atlant Security helps companies close security gaps and pass compliance fast
4 hours: Notify regulators (e.g., national competent authority) within 4 hours of classifying a major inciden
Checklist: SUGGESTED REVIEW FREQUENCY

See also: Insider Threats in Cybersecurity: Identification, Prevention, and Mitigation Strategies

Ready to get started? Atlant Security helps companies close security gaps and pass compliance fast, led personally by a former Microsoft security consultant with 200+ assessments across 14 countries. Book a free strategy call and get a fixed-price proposal within 24 hours.