📚 DORA RTS & ITS

Pillar 1 ICT Risk Management

DORA Articles: 5-16

Applicable RTS: 2024/1774

Key requirements:

• ✅ Documented ICT risk management framework approved by management
• ✅ Complete inventory of ICT assets with criticality classification
• ✅ Risk assessments at least annually
• ✅ Business continuity and disaster recovery policy (BCP/DRP) with regular testing
• ✅ Security controls (access, encryption, monitoring, vulnerability management)

📄 Dedicated PDF: rts-ict-risk-management.html

Pillar 2 Digital Operational Resilience Testing

DORA Articles: 24-27

Applicable framework: TIBER-EU (ECB)

Key requirements:

• ✅ Regular resilience tests (vulnerability scans, pentests, etc.)
• ✅ Mandatory TLPT every 3 years for significant entities
• ✅ TIBER-EU methodology or recognized equivalent
• ✅ Independent Red Team + scenarios based on real threat intelligence
• ✅ Remediation of identified vulnerabilities with timeline

📄 Dedicated PDF: rts-tlpt-guide.html

Pillar 3 ICT-related Incident Management & Reporting

DORA Articles: 17-23

Applicable RTS: 2024/1772 (Classification) + 2025/301 (Reporting)

Applicable ITS: 2025/302 (Templates)

Key requirements:

• ✅ Incident classification according to 6 criteria (clients, duration, geography, data, €, criticality)
• ✅ Major incident reporting:
  • Initial: T+4 hours
  • Intermediate: T+72 hours
  • Final: T+1 month
• ✅ Voluntary notification of significant cyber threats
• ✅ Use of standardized XML templates (ITS 2025/302)

📄 Dedicated PDFs: rts-incident-classification.html + rts-incident-reporting.html

Pillar 4 Third-Party Risk Management

DORA Articles: 28-44

Applicable RTS: 2024/1773 (Contractual clauses) + 2025/532 (Subcontracting)

Applicable ITS: 2024/2956 (Register)

Key requirements:

• ✅ Mandatory contractual clauses:
  • Access and audit rights (including for supervisors)
  • Data location and sovereignty
  • Incident notification (2h max)
  • Termination rights and exit strategy
  • Subcontracting control
• ✅ ICT provider register: Annual transmission to authorities (first time: 30 April 2025)
• ✅ Due diligence before subcontracting + 30-day notification + customer approval
• ✅ Limitation of cascading subcontracting (max 2 levels for critical functions)

📄 Dedicated PDF: rts-third-party-risk.html

Pillar 5 Information Sharing

DORA Articles: 45-47

RTS/ITS status: No specific RTS (voluntary arrangements)

Key requirements:

• ✅ Possibility to establish voluntary arrangements for sharing cyber threat information
• ✅ Protection of sensitive and commercial data
• ✅ No legal obligation, but strongly encouraged
• ✅ Examples: Sectoral ISACs, IOC sharing (Indicators of Compromise)

📄 Documentation: ESA Guidelines (no dedicated RTS)

• ☑️ Incident Management:
  • Implement classification process (RTS 2024/1772)
  • Create notification templates
  • Obtain access to supervisor portal + eIDAS certificates
  • Train IT/SOC teams on reporting deadlines (4h/72h/1 month)
• ☑️ ICT Provider Register:
  • List ALL ICT providers
  • Complete register according to ITS 2024/2956 template
  • Submit before 30 April 2025 (ABSOLUTE DEADLINE)
• ☑️ Governance:
  • Board briefing on DORA obligations
  • Designation of ICT risk management function
  • Validation of ICT risk strategy

• ☑️ Third-Party Risk Management:
  • Gap analysis of all existing contracts vs. RTS 2024/1773
  • Launch contract renegotiations (critical functions priority)
  • Implement subcontracting approval process (RTS 2025/532)
• ☑️ ICT Risk Management:
  • Complete ICT asset inventory
  • Classification by criticality
  • First complete risk assessment
  • Documentation of ICT policies compliant with RTS 2024/1774
• ☑️ BCP/DRP:
  • Review continuity plans
  • Define RTO/RPO
  • Test plans (at least annually)

• ☑️ Contract Finalization:
  • Complete renegotiations with ALL critical/important providers
  • Migrate to new providers if DORA clauses refused
• ☑️ Security Controls:
  • Enhanced monitoring (SIEM, logs, alerting)
  • Generalized MFA implementation
  • Improved network segmentation
  • Patch management program
• ☑️ Audits & Tests:
  • Internal DORA compliance audits
  • Annual pentests
  • BCP/DRP tests

• ☑️ TLPT (if significant entity):
  • Start planning 18 months before (mid-2026)
  • Selection of TIBER-EU providers (Q3-Q4 2026)
  • Test execution (2027)
  • Completion before 17 January 2028
• ☑️ Continuous Improvement:
  • Integration of lessons learned from incidents
  • Process optimization
  • Annual review of all DORA elements

1. Pillar-by-Pillar Approach

Don't do everything at once. Prioritize:

1. Pillar 3 (Incidents): Immediate risk if incident occurs from January 2025
2. Pillar 4 (Third-Party): Register deadline 30 April 2025
3. Pillar 1 (Risk Management): Foundation for everything else
4. Pillar 2 (Testing): Longer timeline (TLPT 2028)
5. Pillar 5 (Sharing): Voluntary, consider later

2. Internal Resources

Build a cross-functional team:

• 🏢 Executive sponsor: Board member (DORA mandatory)
• 👤 DORA project leader: Centralized coordination
• 🔐 CISO / IT Security: Technical aspects
• ⚖️ Compliance / Legal: Regulatory interpretation
• 📊 Risk Management: Risk assessments
• 💻 IT Operations: Practical implementation
• 🤝 Procurement: Vendor contract management

3. Budgeting

Ballpark figures for average entity:

• 💰 External consultants: €200k - €500k (gap analysis, support)
• 💰 Technology tools: €100k - €300k/year (SIEM, GRC platform, monitoring)
• 💰 Contract renegotiations: €50k - €200k (legal resources)
• 💰 TLPT (if applicable): €150k - €500k every 3 years
• 💰 Staff training: €50k - €100k
• TOTAL first year: €500k - €1.5M
• Annual run rate: €200k - €500k

4. Points of Vigilance

• ⚠️ Don't underestimate timelines: Contract renegotiations can take 6-12 months
• ⚠️ Hyperscaler resistance: AWS/Azure/GCP have their own timelines, anticipate
• ⚠️ Exhaustive documentation required: Plan resources for writing/maintenance
• ⚠️ Ongoing operational burden: DORA is not a one-shot project but a permanent change