DORA Compliance Checker

Documented ICT risk management framework approved by management body

Art. 6

ICT risk management function with clear responsibilities

Art. 6(4)

Annual review and update of ICT risk framework

Art. 6(5)

ICT business continuity policy in place

Art. 11

ICT incident classification process established

Art. 17-18

Major incident reporting procedures to competent authorities

Art. 19

Incident root cause analysis procedures

Art. 17(3)

ICT testing program covering all critical systems

Art. 24

Vulnerability assessments performed regularly

Art. 25

Threat-led penetration testing (TLPT) at least every 3 years for entities identified by the competent authority

Art. 26(1)

Register of all ICT third-party service providers

Art. 28(3)

Due diligence process for ICT third-party providers

Art. 28(4)

Contractual arrangements meeting DORA requirements

Art. 30

Exit strategies for critical ICT third-party services

Art. 28(8)

Cyber threat intelligence sharing arrangements considered (optional/voluntary)

Art. 45