All DORA RTS & ITS Standards: Complete Overview

Pillar 1 ICT Risk Management

DORA Articles: 5-16

Applicable RTS: 2024/1774

Key requirements:

• Documented ICT risk management framework approved by management
• Complete inventory of ICT assets with criticality classification
• Identification of Critical or Important Functions (CIFs): the cornerstone concept that drives every other DORA obligation
• Risk assessments at least annually
• Business continuity and disaster recovery policy (BCP/DRP) with regular testing
• Security controls (access, encryption, monitoring, vulnerability management)

Dedicated guide: rts-ict-risk-management.html · CIF methodology

Pillar 2 Digital Operational Resilience Testing

DORA Articles: 24-27

Applicable RTS: 2025/1190 (TLPT, drafted in accordance with the TIBER-EU framework)

Key requirements:

• Regular resilience tests (vulnerability scans, pentests, etc.)
• TLPT at least every 3 years for financial entities identified by their competent authority (Art. 26(1) and (8))
• TIBER-EU methodology or recognized equivalent
• Independent Red Team + scenarios based on real threat intelligence
• Remediation of identified vulnerabilities with timeline

Dedicated guide: rts-tlpt-guide.html

Pillar 3 ICT-related Incident Management & Reporting

DORA Articles: 17-23

Applicable RTS: 2024/1772 (Classification) + 2025/301 (Reporting)

Applicable ITS: 2025/302 (Templates)

Key requirements:

• Incident classification according to 7 RTS 2024/1772 criteria: (1) clients/transactions, (2) reputational impact, (3) duration, (4) geographical spread, (5) data losses, (6) criticality of services affected, (7) economic impact
• Major incident reporting:
  • Initial: T+4 hours
  • Intermediate: T+72 hours
  • Final: T+1 month
• Voluntary notification of significant cyber threats
• Use of standardized XML templates (ITS 2025/302)

Dedicated guides: rts-incident-classification.html + rts-incident-reporting.html

Pillar 4 Third-Party Risk Management

DORA Articles: 28-44

Contract clauses: DORA Article 30 (9 elements for every ICT contract, 6 more for critical or important functions)

Applicable RTS: 2024/1773 (Third-party policy) + 2025/532 (Subcontracting)

Applicable ITS: 2024/2956 (Register)

Key requirements:

• Mandatory contractual clauses (Art. 30):
  • Service description, locations of services and data, data protection and return (every contract)
  • Incident assistance, cooperation with authorities, termination rights and notice periods (every contract)
  • Full service levels, contingency plans, TLPT participation (critical or important functions)
  • Unrestricted access, inspection and audit rights, exit strategy with a transition period (critical or important functions)
• ICT provider register: Annual transmission to authorities (first time: 30 April 2025)
• Subcontracting of critical or important functions: assessment before signing, contract conditions, notice of material changes with a reasonable period to approve or object (RTS 2025/532, Art. 3 to 5)
• Termination if the provider subcontracts or changes the chain against the contract (RTS 2025/532, Art. 6)

Dedicated guide: rts-third-party-risk.html

Pillar 5 Information Sharing

DORA Articles: 45-47

RTS/ITS status: No specific RTS (voluntary arrangements)

Key requirements:

• Possibility to establish voluntary arrangements for sharing cyber threat information
• Protection of sensitive and commercial data
• No legal obligation, but strongly encouraged
• Examples: Sectoral ISACs, IOC sharing (Indicators of Compromise)

Documentation: ESA Guidelines (no dedicated RTS)

• Incident Management:
  • Implement classification process (RTS 2024/1772)
  • Create notification templates
  • Obtain access to supervisor portal + eIDAS certificates
  • Train IT/SOC teams on reporting deadlines (4h/72h/1 month)
• ICT Provider Register:
  • List ALL ICT providers
  • Complete register according to ITS 2024/2956 template
  • Submit before 30 April 2025 (ABSOLUTE DEADLINE)
• Governance:
  • Board briefing on DORA obligations
  • Designation of ICT risk management function
  • Validation of ICT risk strategy

• Third-Party Risk Management:
  • Gap analysis of all existing contracts vs. DORA Article 30
  • Launch contract renegotiations (critical functions priority)
  • Implement subcontracting approval process (RTS 2025/532)
• ICT Risk Management:
  • Complete ICT asset inventory
  • Classification by criticality
  • First complete risk assessment
  • Documentation of ICT policies compliant with RTS 2024/1774
• BCP/DRP:
  • Review continuity plans
  • Define RTO/RPO
  • Test plans (at least annually)

• Contract Finalization:
  • Complete renegotiations with ALL critical/important providers
  • Migrate to new providers if DORA clauses refused
• Security Controls:
  • Enhanced monitoring (SIEM, logs, alerting)
  • Generalized MFA implementation
  • Improved network segmentation
  • Patch management program
• Audits & Tests:
  • Internal DORA compliance audits
  • Annual pentests
  • BCP/DRP tests

• TLPT (if identified by your competent authority, Art. 26(8)):
  • Prepare before notification: initiation information is due within 3 months of the TLPT authority's notification (RTS 2025/1190, Art. 9(2))
  • Scope specification document, approved by the management body, within 6 months of the notification (Art. 9(6))
  • Active red team testing phase of at least 12 weeks (Art. 11(5))
  • Repeat at least every 3 years (DORA Art. 26(1)); the competent authority may shorten or extend that frequency
• Continuous Improvement:
  • Integration of lessons learned from incidents
  • Process optimization
  • Annual review of all DORA elements

1. Pillar-by-Pillar Approach

Don't do everything at once. Prioritize:

1. Pillar 3 (Incidents): Immediate risk if incident occurs from January 2025
2. Pillar 4 (Third-Party): Register deadline 30 April 2025
3. Pillar 1 (Risk Management): Foundation for everything else
4. Pillar 2 (Testing): Longer timeline (TLPT starts on notification from the TLPT authority)
5. Pillar 5 (Sharing): Voluntary, consider later

2. Internal Resources

Build a cross-functional team:

• Executive sponsor: Board member (DORA mandatory)
• DORA project leader: Centralized coordination
• CISO / IT Security: Technical aspects
• Compliance / Legal: Regulatory interpretation
• Risk Management: Risk assessments
• IT Operations: Practical implementation
• Procurement: Vendor contract management

3. Budgeting

DORA and its RTS set no cost figures, and we do not publish ballpark ranges we cannot source. Budget by cost line, sized on your own scope:

• External support: gap analysis and implementation support, driven by the pillars and entities in scope
• Technology tools: monitoring, logging and GRC tooling, usually a recurring annual cost
• Contract remediation: legal time to bring ICT contracts in line with Art. 30, driven by the number of contracts supporting critical or important functions
• TLPT (only if your competent authority identifies you, Art. 26(8)): threat intelligence provider, external testers and internal control team time, for an active red team phase of at least 12 weeks (RTS 2025/1190, Art. 11(5)), at least every 3 years
• Staff training: including the ICT risk training of the management body (Art. 5(4))

4. Points of Vigilance

• Don't underestimate timelines: Contract renegotiations can take 6–12 months
• Hyperscaler resistance: AWS/Azure/GCP have their own timelines, anticipate
• Exhaustive documentation required: Plan resources for writing/maintenance
• Ongoing operational burden: DORA is not a one-shot project but a permanent change