DORA · ISO/IEC 27001:2022 + ISO 22301:2019
How resilient is your organisation under DORA?
70 requirements covering the five DORA pillars (ICT risk management, incident management and reporting, resilience testing, ICT third-party risk, information sharing) plus governance, with the delegated and implementing regulations adopted up to October 2026 and the first designations of critical ICT third-party providers. Each requirement is mapped to ISO/IEC 27001:2022 Annex A controls and ISO 22301:2019 clause 8 requirements. You get compliance percentages, prioritised gaps, guidance and a PDF report. For financial entities and ICT third-party providers across the EU; national supervisory specifics are out of scope.
No data from this assessment is transmitted to GoToCertify.
How it works
- Profile: a few facts and yes/no questions exclude non-applicable requirements.
- Assessment: a 0-4 maturity level per requirement, with evidence and notes.
- Dashboard: compliance % by area, by source and by control group; P1/P2 gaps.
- PDF report: results, prioritised action plan with guidance, control map, roadmap.
70 requirements · 13 assessment areas · mapped to ISO 27001 / 22301 · 60-120 minutes
DORA (Reg. (EU) 2022/2554)Applicable since 17/01/2025: governance (Art. 5), ICT risk management (Art. 6-16), incident classification and reporting (Art. 17-23), resilience testing and TLPT (Art. 24-27), ICT third-party risk and CTPP oversight (Art. 28-44), information sharing (Art. 45).
RTS / ITS (2024-2025)Del. Reg. 2024/1772, 2024/1773, 2024/1774 (classification, third-party policy, risk framework), Impl. Reg. 2024/2956 (register), Del. Reg. 2025/301 and Impl. Reg. 2025/302 (reporting), Del. Reg. 2025/532 (subcontracting), 2025/1190 (TLPT), 2024/1502, 2024/1505 and 2025/420 (oversight).
ISO/IEC 27001:2022 + ISO 22301:2019Each requirement is linked to Annex A controls of ISO/IEC 27001 and to clause 8 of ISO 22301 (BIA, strategies, plans, exercises, evaluation); the coverage map supports a Statement of Applicability and the integration of security and continuity management systems.
Assessment areas
- GOV – Governance and management body
DORA places ultimate responsibility for ICT risk on the management body (Art. 5): it must approve the framework, set risk tolerance, allocate budget, be trained and oversee third-party arrangements. Make board decisions traceable in minutes and keep a DORA compliance dashboard for the board. Microenterprises and entities under the simplified framework (Art. 16) apply these duties proportionately. - RMF – ICT risk management framework
Art. 6 and Delegated Regulation (EU) 2024/1774 define a documented framework: strategies, policies, procedures, protocols and tools, reviewed yearly and after major incidents, with an independent control function and internal audit coverage. Entities eligible for Art. 16 apply the simplified framework of the same Delegated Regulation. Supervisors in 2025-2026 found many policies missing or not aligned with 2024/1774: self-assess each policy against the Delegated Regulation. - IDP – Identification, protection and prevention
Art. 8-9: inventory all ICT-supported business functions, assets, dependencies and third parties; identify legacy systems; implement security policies on access, authentication, cryptography, patching, network security and change management. Supervisory findings highlight logical access management and patch/vulnerability management as weak spots. - DET – Detection, response and recovery
Art. 10-11: detection mechanisms with multiple layers of control and alert thresholds, an ICT business continuity policy, response and recovery plans with RTO/RPO per function, crisis management and yearly testing. ISO 22301 clause 8 gives the structure (BIA, strategies, plans, exercises, evaluation). - BCK – Backup, restoration and redundancy
Art. 12 and Del. Reg. (EU) 2024/1774 Art. 8(2) (backup and restore requirements): backup policies defining scope and frequency based on criticality, physically and logically segregated backup systems, restoration tested, and redundant ICT capacity. Central counterparties have stricter requirements (2-hour recovery). - LRN – Learning, evolving and communication
Art. 13-14: post-incident reviews, threat and vulnerability intelligence, lessons from testing, mandatory ICT security awareness for all staff including the management body, and crisis communication plans with named spokespersons for clients, counterparts and the public. - INC – ICT-related incident management and classification
Art. 17-18 and Delegated Regulation (EU) 2024/1772: an incident management process with early warning, root-cause analysis, escalation and recording; classification of every incident against the criteria (clients/counterparts affected, duration, geographic spread, data losses, criticality of services, economic impact) with the materiality thresholds that make an incident major. Also classify significant cyber threats. - REP – Incident reporting to authorities
Art. 19-23 with Delegated Regulation (EU) 2025/301 and Implementing Regulation (EU) 2025/302: initial notification within 4 hours from classification as major and no later than 24 hours from awareness, intermediate report within 72 hours from the initial notification, final report within one month from the (latest) intermediate report, using the ITS templates and the competent authority's submission channel (ESAs operational instructions of 16/09/2026). Voluntary notification of significant cyber threats. Inform clients where the incident affects their financial interests. A Digital Omnibus proposal (November 2025) for a single EU reporting entry point is under negotiation. - TST – Digital operational resilience testing
Art. 24-27: a risk-based testing programme covering all critical ICT systems at least yearly (vulnerability assessments, scenario-based tests, source code reviews, penetration tests), full remediation tracking, and threat-led penetration testing (TLPT) at least every three years for entities identified by the competent authority, under Delegated Regulation (EU) 2025/1190 (TIBER-EU aligned, in force 08/07/2025). Microenterprises are exempt from Art. 24-26 obligations other than a proportionate programme (Art. 25(1)). - TPS – ICT third-party risk: strategy and register
Art. 28 and Delegated Regulation (EU) 2024/1773: a multi-vendor strategy, a policy on ICT services supporting critical or important functions, pre-contractual due diligence, concentration risk assessment and a register of information per Implementing Regulation (EU) 2024/2956 kept at entity, sub-consolidated and consolidated level and submitted yearly to the competent authority (2026 exercise: reference date 31/12/2025, national deadlines in March 2026; next exercise Q1 2027 with reference date 31/12/2026). - TPC – Contracts, subcontracting and exit
Art. 30 lists mandatory contractual provisions (service descriptions, locations, data protection, access, audit and inspection rights, termination rights, SLAs, incident assistance, participation in TLPT, exit periods). Delegated Regulation (EU) 2025/532 (in force 22/07/2025) adds conditions for subcontracting ICT services supporting critical or important functions. Exit strategies and tested exit plans are required for all critical or important functions. - CTP – Critical ICT third-party providers and oversight
Art. 31-44: the ESAs designated the first 19 critical ICT third-party providers on 18/11/2025 (criteria in Delegated Regulation (EU) 2024/1502, fees in 2024/1505, joint examination teams in 2025/420, Guide on oversight activities JC 2025 29). Financial entities must take account of Lead Overseer recommendations and the risks of using a CTPP that does not follow them; non-EU CTPPs need an EU subsidiary. ICT third-party providers should prepare for oversight engagement. - ISH – Information sharing, authorities and interplay
Art. 45 allows voluntary cyber threat information-sharing arrangements, to be notified to the competent authority. DORA is lex specialis to NIS2 for financial entities (Art. 1(2) DORA; Art. 4 NIS2). Keep relations with the competent authority, the TLPT authority and CSIRTs structured, and track national implementing acts and the DORA review due by 17/01/2028 (Art. 58).
Key regulatory dates
| Date | Source | Status | |
|---|---|---|---|
| 16/01/2023 | DORA | Entry into force of Regulation (EU) 2022/2554 (OJ L 333, 27.12.2022) | Past |
| 17/01/2025 | DORA | DORA applies in full to all financial entities; first set of RTS (2024/1772, 2024/1773, 2024/1774) and register ITS (2024/2956) applicable | In force |
| 12/03/2025 | RTS/ITS | Del. Reg. (EU) 2025/301 and Impl. Reg. (EU) 2025/302 on major incident reporting and cyber threat notification enter into force | In force |
| 30/04/2025 | DORA | First collection of registers of information by the ESAs via competent authorities (reference date 31/03/2025); basis for CTPP criticality assessment | Past |
| 22/07/2025 | RTS/ITS | Del. Reg. (EU) 2025/532 on subcontracting of ICT services supporting critical or important functions enters into force | In force |
| 08/07/2025 | RTS/ITS | Del. Reg. (EU) 2025/1190 on TLPT (TIBER-EU aligned, OJ L 18.6.2025) enters into force; TLPT authorities launch the first cycles | In force |
| 18/11/2025 | DORA | ESAs designate the first 19 critical ICT third-party providers; oversight engagement starts | In force |
| 19/11/2025 | DORA | Commission Digital Omnibus proposal (COM(2025) 837) incl. single entry point for incident reporting across DORA/NIS2/GDPR - under negotiation | Proposal |
| 31/03/2026 | DORA | 2026 annual register of information exercise (reference date 31/12/2025): national submission windows in March, authorities forward registers to the ESAs by end of March; yearly thereafter (next: Q1 2027, reference date 31/12/2026) | Done - repeat yearly |
| 16/09/2026 | RTS/ITS | ESAs operational instructions for DORA major incident reporting published (templates in English, identifiers, thresholds) | In force |
| 18/11/2026 | DORA | Third-country CTPPs designated in 2025 must have established a subsidiary in the Union (12 months from designation) | Imminent |
| 17/01/2028 | DORA | Commission review of DORA (Art. 58) due; indicative end of the first 3-year TLPT cycle for entities identified at application | Future |
Frequently asked questions
Is the DORA self-assessment free?
Yes. The tool is free, requires no account and stores nothing on our servers: the assessment runs entirely in your browser and you download the PDF report and an optional save file to your computer.
Which standard is the DORA assessment mapped to?
Every requirement is linked to the controls of ISO/IEC 27001:2022 + ISO 22301:2019. The coverage map produced by the tool can be used as a basis for a Statement of Applicability.
How is the compliance percentage calculated?
Each applicable requirement is scored on a maturity scale from 0 (not started) to 4 (fully compliant). The compliance percentage is the ratio between the score obtained and the maximum obtainable. Priorities P1/P2/P3 combine criticality and maturity level.
Who is the assessment for?
Compliance, legal, IT security and risk functions of organisations established or operating in the EU; it is a self-assessment and does not constitute legal advice.
How up to date is the regulatory content?
The regulatory snapshot is dated 2026-10-31 (version 1.0). Proposals not yet adopted are labelled as such. References point to official sources (EUR-Lex, European authorities, ISO).
Other assessments
- EU AI Act – Regulation (EU) 2024/1689 as amended by the Digital Omnibus – mapped to ISO/IEC 42001:2023
- GDPR – Regulation (EU) 2016/679 with EDPB guidance – mapped to ISO/IEC 27701:2025
- NIS2 Directive – Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690 - mapped to ISO/IEC 27001:2022
- AI Act – Italia – AI Act, L. 132/2025, D.Lgs. 160/2026 e 179/2026 – mappato su ISO/IEC 42001:2023 (contenuti in italiano)
Self-assessment tool for information purposes only; it does not constitute legal advice. References and dates must be verified against the official texts (EUR-Lex, ESAs, competent authorities). No data from this assessment is transmitted to GoToCertify. © 2026 GoToCertify.