A control library you can implement, test, and audit.
Built from DORA Chapter II + the Level 2 RTS for ICT risk management tools and simplified framework.
Structured answer sets in this page tree.
Cited legal and guidance references.
DORA Chapter II expects a coherent ICT risk management framework, not a stack of disconnected policies. The easiest way to ship compliance is to build a control baseline: control -> owner -> acceptance criteria -> evidence. This page provides an implementation-ready baseline you can adapt by proportionality and connect to incident reporting and testing programs.
Build the library around control families that match how systems fail and how supervisors ask questions: inventory -> protect -> detect -> respond -> recover -> learn.
Use one evidence model across all families: logs + reports + approvals + tests.
DORA ties ICT risk management to governance: management bodies define, approve and oversee the ICT risk framework and continuity planning.
Treat governance controls as evidence-producing processes (not just policies).
Article 8 requires identifying, classifying and documenting ICT-supported business functions, information assets and ICT assets, and their roles/dependencies in relation to ICT risk - and reviewing at least yearly.
This is the root of almost every other DORA control: you can't protect or recover what you can't list.
Protection controls reduce incident frequency and blast radius. DORA expects safeguards against intrusions and data misuse and preservation of availability, authenticity, integrity and confidentiality of data.
Implement these controls as "standards + enforcement + verification".
DORA expects prompt detection of anomalous activities and ICT-related incidents and identification of single points of failure.
Make detection measurable: coverage, alert quality, and time-to-detect.
Assessment Autopilot can take EU DORA ICT Risk Management Baseline from turning this guidance into a repeatable review process to a reusable workflow inside Sorena. Teams working on EU DORA can keep owners, evidence, and next steps aligned without copying this guide into separate documents.
Start from EU DORA ICT Risk Management Baseline and turn the guidance into owned tasks, evidence requests, and review checkpoints.
Review your current process, evidence gaps, and next steps for EU DORA ICT Risk Management Baseline.
DORA requires a comprehensive ICT business continuity policy and associated ICT response and recovery plans.
Treat response and recovery as practiced operations: runbooks + exercises + measured outcomes.
DORA incident workflows explicitly include communication plans to staff, stakeholders and media and escalation to senior management and the management body for major incidents.
This is a control surface: clarity and speed matter during outages.
DORA expects proportional application of controls and allows simplified frameworks for certain entities. The Level 2 RTS specifies tools, methods, processes and policies and the simplified approach.
The mistake is treating "simplified" as "uncontrolled". Your simplified framework still needs evidence and review cadence.
If you can't export evidence quickly, you'll end up rebuilding it during supervisory requests or audits.
Use this list as your "evidence readiness" acceptance criteria.