EU DORA Compliance Checklist

Start with the management-body and framework checks. DORA makes the management body responsible for defining, approving, overseeing, and being responsible for the implementation of ICT risk management arrangements. First record whether the entity follows the general Chapter II framework or qualifies for the Article 16 simplified ICT risk management framework; the governance and control checklist must follow that legal branch.

For entities outside the Article 16 simplified framework, Article 6(5) requires the ICT risk management framework to be documented and reviewed at least yearly, or periodically for microenterprises, and after major incidents or relevant supervisory, testing or audit findings. Article 6(6) requires regular internal audit in line with the audit plan for entities other than microenterprises.

The regulation and cited technical standards are binding. The checklist grouping, evidence labels, and suggested ownership records are practical controls and do not create a safe harbour or replace the applicable authority's forms and procedures.

The incident checklist should separate classification from reporting. First classify the ICT-related incident using DORA's criteria and materiality thresholds; then prepare the initial notification, intermediate report, and final report using the reporting content and template rules.

Do not rely on severity labels from an internal ticketing tool unless they map to the DORA criteria. The evidence record should show the data used for each criterion and whether the incident affected critical services.

The testing part of the checklist should prove that testing is risk-based, covers ICT systems and applications supporting critical or important functions, and produces remediated findings rather than only test reports.

Threat-led penetration testing is a separate advanced-testing track. DORA requires TLPT for financial entities identified under the TLPT criteria, and the TLPT scope should cover several or all critical or important functions and relevant underlying ICT systems, processes, technologies, and ICT services.

DORA treats ICT third-party risk as part of the ICT risk management framework. The checklist should verify both the contract clauses and the register-of-information record, because supervisors can request the full register or specified sections.

Use one evidence row per ICT service arrangement, distinguishing ICT services supporting critical or important functions from other ICT services. For critical or important functions, the contract and monitoring record should be more detailed.

The checklist is only useful if every completed item leaves an auditable record. Keep the evidence close to the obligation, not buried in project notes. A reviewer should be able to trace each item to a DORA requirement, an owner, a system or supplier, and a current artifact.

This section is the minimum record set for recurring DORA reviews, management-body updates, internal audit, supplier governance meetings, and supervisory requests.