DORA gap analysis: the workbook, the method and the report template
The measurement instrument behind the free Gap Analysis Starter, plus the two things a spreadsheet never gave you: a methodology guide telling you how to run the assessment, and a report template for handing the result to a board or a client.
What this solves
A gap analysis is only as good as the question list behind it, and most improvised ones measure what the assessor already knows about. The output then reads as a set of opinions, which is exactly what a board or a client will not act on.
Two things separate a usable assessment from a spreadsheet: a method that says who to interview and what counts as evidence, and a report format that turns scores into a decision.
What is inside
- Workbook (Excel): 176 requirements across Articles 5–45, all five pillars
- Scoping tab: simplified regime, micro-entity, TLPT, payment, CTPP and CIF flags
- Maturity scoring 0–4 with a compliance threshold at 3
- Self-filling prioritised action plan (owner, date, priority)
- Evidence register cross-referenced to every requirement
- Heatmap by pillar and article
- Dashboard tab with board-ready charts
- Regulatory mapping tab: Article, RTS and ITS references
- Methodology guide (PDF): the four phases, who to interview, what counts as evidence, how to score the 2-or-3 boundary defensibly
- Report template (Word): executive summary, scope, results by pillar, critical gaps, remediation plan
What it covers in the regulation
- All five DORA pillars — Articles 5–45
- Article 6(5) — the yearly framework review this feeds
- RTS (EU) 2024/1774 — ICT risk management tools
- Article 16 — simplified regime scoping
Who uses it, and when
Consultants running an assessment for a client, and internal teams preparing for audit or for the yearly review. Used at the start of a programme, and again to show movement.
How to work through it
- Scope first: the simplified regime changes which requirements apply to you.
- Work the questionnaire with the methodology guide beside it, so scoring is consistent between assessors.
- Score against evidence, not intent — the difference is the whole value of the exercise.
- Produce the report from the template so the result lands as a decision, not a spreadsheet.