The complete checklist of server hardening controls required by DORA, mapped to Commission Delegated Regulation (EU) 2024/1774 (RTS on ICT risk management). 8 control domains, 60+ specific requirements.
DORA does not publish a single "server hardening" checklist. The requirements are distributed across RTS 2024/1774 (ICT risk management framework) — specifically Articles 4-15 covering ICT security policies, access management, cryptography, ICT operations, network security, and vulnerability management. This page consolidates them into a single auditable hardening reference.
Server hardening under DORA is governed by eight interlocking control domains. Each maps to specific articles of RTS 2024/1774 and applies to all ICT systems supporting Critical or Important Functions (CIFs).
Strong authentication, MFA, privileged access management, least privilege.
Encryption at rest and in transit, key management, certificate lifecycle.
Secure baselines, change management, hardening templates.
Segmentation, firewalls, intrusion detection, secure protocols.
Scanning, patching, remediation timelines tied to severity.
Centralised logs, integrity protection, retention, real-time alerting.
EDR, anti-malware, hardened OS images, application control.
Offline backups, integrity verification, tested recovery time objectives.
RTS 2024/1774 Art. 21 requires ICT systems supporting CIFs to enforce strong authentication, segregation of duties, and continuous review of privileged access. Specific server hardening controls:
/etc/ssh/sshd_configRTS 2024/1774 Art. 6 requires encryption of data at rest and in transit, with documented key management. Specific server requirements:
RTS 2024/1774 Art. 14 requires documented secure configuration baselines and a formal change management process. Server hardening practices:
RTS 2024/1774 Art. 13 requires network segmentation and traffic filtering for ICT systems supporting CIFs:
RTS 2024/1774 Art. 10 requires a documented vulnerability management process with patching SLAs based on severity:
| Severity | CVSS | Patch SLA | Compensating control if delayed |
|---|---|---|---|
| Critical | 9.0+ | 72 hours | WAF rule, network isolation, monitoring escalation |
| High | 7.0–8.9 | 14 days | Documented mitigation + risk acceptance |
| Medium | 4.0–6.9 | 30 days | Tracked in risk register |
| Low | 0.1–3.9 | Next maintenance window | Documented in next review |
RTS 2024/1774 Art. 15 requires comprehensive logging with integrity protection, retention, and real-time monitoring:
RTS 2024/1774 Art. 11-12 require backup integrity and tested recovery aligned with the RTO defined for each CIF:
Maintaining 60+ hardening controls across hundreds of servers manually is impossible at audit scale. Resiplan — the specialised SaaS for DORA, business continuity and GRC — provides a built-in hardening control library mapped to RTS 2024/1774, with continuous evidence collection, drift alerts, and audit-ready reports.
Try Resiplan FreeNo. DORA is principle-based: it requires effective hardening but does not prescribe a specific framework. The most defensible approach is to adopt CIS Benchmarks or STIG as the technical baseline and document the mapping to RTS 2024/1774 articles.
Hardening controls in RTS 2024/1774 apply with higher intensity to ICT systems supporting CIFs. Non-CIF systems must still meet baseline ICT security requirements (proportionality principle, DORA Art. 4) but with less-strict SLAs and evidence requirements.
Continuous configuration monitoring is expected (drift detection) plus a formal annual review. After any material change (OS upgrade, application migration, infrastructure refactor), re-validation is mandatory.
Indirectly. TLPT (Threat-Led Penetration Testing) exercises real attack scenarios and frequently expose hardening gaps as findings. A robust hardening programme typically reduces TLPT severity findings by 60-80%.
Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.