DORA Lead Manager cheat sheet

DORA applies to financial entities (credit institutions, payment institutions, investment firms, insurers, etc.) and to ICT third-party service providers designated as critical (CTPPs).

Digital operational resilience means the ability to build, assure, and review ICT operational integrity and reliability, ensuring continuity of financial services under disruption.

ICT risk is defined as any reasonably identifiable circumstance related to ICT that, if materialized, may compromise the security of network and information systems.

The five pillars of DORA: ICT risk management, ICT-related incident management, digital operational resilience testing, ICT third-party risk management, and information sharing.

Proportionality principle: requirements apply according to the entity's size, business profile, and risk exposure, but core obligations are non-negotiable.

Management body bears ultimate responsibility for ICT risk; must define risk appetite, approve policies, and allocate resources.

DORA is a regulation (EU) 2022/2554, directly applicable in all Member States, complemented by Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS).

Key distinction: DORA focuses on operational resilience of ICT, not on prudential capital requirements, though it interacts with CRR/CRD and Solvency II.

Register of information: financial entities must maintain a register of all contractual arrangements with ICT third-party providers, updated regularly and reported to supervisors.

Gap analysis: map current ICT risk management, incident reporting, testing, and third-party oversight against DORA articles and RTS/ITS to identify deficiencies.

Governance setup: appoint a DORA programme lead, establish a steering committee with business, IT, risk, compliance, and legal representation.

Define a target operating model that integrates DORA obligations into existing processes (e.g., incident management, procurement, testing).

Develop a roadmap with phases: assessment, design, implementation, testing, and continuous improvement; include milestones and dependencies.

Resource planning: budget for tools (e.g., register of information, incident reporting platform), training, and external assurance.

Stakeholder engagement: align with supervisors, internal audit, and third-party providers early to manage expectations and data needs.

Documentation: create a DORA compliance charter, policies, and procedures; ensure version control and audit trails.

Change management: communicate impacts to all staff and provide training on new DORA-driven processes.

Monitoring: set KPIs and KRIs to track implementation progress and effectiveness; report regularly to the management body.

ICT risk management framework must include identification, protection, detection, response, recovery, and learning; aligned with ISO 27001 and NIST CSF.

Incident classification: major ICT-related incidents are those with material impact on critical services, affecting clients, counterparties, or market integrity.

Reporting timeline: major incidents must be reported to competent authorities within 4 hours of classification (initial notification), followed by intermediate and final reports.

Incident response plan: define roles, escalation paths, communication protocols, and post-incident reviews; test annually.

Business continuity: maintain ICT business continuity policy and disaster recovery plans; test at least annually or after significant changes.

Root cause analysis: required for major incidents; document lessons learned and implement corrective actions.

Incident logging: record all ICT-related incidents, including near misses, with sufficient detail to support classification and reporting.

Cooperation with authorities: provide timely information and updates; designate a single point of contact for incident reporting.

Third-party incidents: ensure providers notify the financial entity without undue delay and assist in reporting obligations.

Testing programme: risk-based, covers all critical ICT systems and processes; includes vulnerability assessments, scenario-based tests, and penetration testing.

Advanced testing: at least every three years, perform threat-led penetration testing (TLPT) for significant entities, covering live production systems.

TLPT scope: defined by the entity and supervisor; must include critical functions and third-party providers; results summarized in a report.

Third-party risk management: conduct due diligence before contracting, ongoing monitoring, and exit strategies for all ICT providers.

Contractual requirements: mandatory clauses on service levels, audit rights, incident notification, data location, subcontracting, and termination.

Register of information: maintain a detailed register of all ICT third-party arrangements, including subcontractors, and report to supervisors annually.

Critical third-party providers (CTPPs): designated by ESAs; subject to oversight framework including recommendations and penalties.

Concentration risk: assess and manage dependency on a small number of ICT providers; consider diversification and substitutability.

Exit plans: ensure ability to migrate or discontinue services without disruption; test exit strategies periodically.

Annual review: the management body must review and approve the ICT risk management framework at least once a year or after significant changes.

Internal audit: independently review the ICT risk management framework and DORA compliance at least annually; report findings to management body.

Performance monitoring: track KPIs such as incident resolution time, testing coverage, and third-party compliance; use results to drive improvements.

Lessons learned: incorporate findings from incidents, tests, and audits into updated policies and procedures.

Regulatory updates: monitor ESA publications (RTS, ITS, guidelines) and adjust compliance programme accordingly.

Training and awareness: provide regular DORA-specific training to staff and management; update content based on emerging risks.

Documentation control: maintain records of reviews, changes, and approvals; ensure auditability.

Continual improvement cycle: plan-do-check-act (PDCA) applied to DORA compliance; set improvement objectives and measure progress.

Supervisory feedback: incorporate feedback from competent authorities into the improvement process; respond to recommendations promptly.