A practical checklist guiding financial entities and ICT providers through DORA compliance,
covering scope, ICT risk management, incident reporting, third-party risk, resilience testing, and
audits.
ComplianceMay 12, 2026
The DORA compliance checklist
Key Takeaways
- Operational resilience is now a regulatory obligation, not an IT issue. DORA makes boards and senior leaders directly accountable for ICT risk management, incident response, and digital resilience across the enterprise.
- Third-party ICT risk is a core driver of enterprise risk exposure. Organizations must formally assess, contract, monitor, and test the resilience of critical ICT service providers to reduce systemic and concentration risk.
- Resilience must be tested, measured, and continuously improved. Regular resilience testing—including advanced threat-led testing—shifts organizations from compliance checklists to proven operational readiness.
- DORA aligns compliance with long-term competitive advantage. Beyond avoiding penalties, strong DORA alignment enhances stakeholder trust, reduces disruption risk, and strengthens market confidence.
Preliminary steps for DORA compliance
Understand DORA’s scope (Article 2)
☐ Review the regulation in detail and analyze your organization’s operations to see if it qualifies as a financial entity or critical third-party information and communication technology (ICT) service provider.
☐ Understand the specific requirements relevant to your organization’s role within the financial ecosystem, such as ICT risk management or incident reporting.
Conduct a gap analysis
☐ Identify where existing ICT risk management frameworks and practices diverge from DORA’s requirements per Article 5 (Article 5).
☐ Evaluate current governance structures, ICT incident response protocols (Article 17), third-party risk management (TPRM) strategies (Articles 28-30), and resilience testing measures to ensure alignment with DORA.
☐ Review existing documentation, such as business continuity plans and ICT policies, to identify weaknesses or areas requiring updates.
Receive a copy of this resource.
Fill out the form below and receive the full checklist in your inbox.
Missing the form below?
To see the form, you will need to change your cookie settings. Click the button below to update your preferences to accept all cookies. For more information, please review our Privacy & Cookie Notice.
Related Insights
-
ReportComplianceApril 23, 2026
Collaboration without compromise: Practitioner perspectives on internal audit, risk management, and governance practices
Risk, governance, and assurance activities are evolving as organizations seek greater connectedness, coordination, and insight across the second and third lines. -
ReportComplianceApril 15, 2026
The NIS2 compliance checklist
The NIS2 checklist supports greater compliance and ensures your organization’s cybersecurity practices are aligned with the directive’s requirements. -
ReportComplianceApril 08, 2026
The ISO 27001 compliance checklist
This checklist will help your organization build a strong, secure, and compliant ISMS that leads to enhanced security and improved business resilience. -
ReportComplianceMarch 12, 2026
The SOC 2 compliance checklist
SOC 2 manages customer data based on five Trust Services Criteria (TSC): Security, Availability, Processing Integrity, Confidentiality, and Privacy.