All DORA RTS & ITS Standards: Complete Overview

Pillar 1 ICT Risk Management

DORA Articles: 5-16

Applicable RTS: 2024/1774

Key requirements:

• Documented ICT risk management framework approved by management
• Complete inventory of ICT assets with criticality classification
• Identification of Critical or Important Functions (CIFs): the cornerstone concept that drives every other DORA obligation
• Risk assessments at least annually
• Business continuity and disaster recovery policy (BCP/DRP) with regular testing
• Security controls (access, encryption, monitoring, vulnerability management)

Dedicated guide: rts-ict-risk-management.html · CIF methodology

Pillar 2 Digital Operational Resilience Testing

DORA Articles: 24-27

Applicable framework: TIBER-EU (ECB)

Key requirements:

• Regular resilience tests (vulnerability scans, pentests, etc.)
• Mandatory TLPT every 3 years for significant entities
• TIBER-EU methodology or recognized equivalent
• Independent Red Team + scenarios based on real threat intelligence
• Remediation of identified vulnerabilities with timeline

Dedicated guide: rts-tlpt-guide.html

Pillar 3 ICT-related Incident Management & Reporting

DORA Articles: 17-23

Applicable RTS: 2024/1772 (Classification) + 2025/301 (Reporting)

Applicable ITS: 2025/302 (Templates)

Key requirements:

• Incident classification according to 7 RTS 2024/1772 criteria: (1) clients/transactions, (2) reputational impact, (3) duration, (4) geographical spread, (5) data losses, (6) criticality of services affected, (7) economic impact
• Major incident reporting:
  • Initial: T+4 hours
  • Intermediate: T+72 hours
  • Final: T+1 month
• Voluntary notification of significant cyber threats
• Use of standardized XML templates (ITS 2025/302)

Dedicated guides: rts-incident-classification.html + rts-incident-reporting.html

Pillar 4 Third-Party Risk Management

DORA Articles: 28-44

Applicable RTS: 2024/1773 (Contractual clauses) + 2025/532 (Subcontracting)

Applicable ITS: 2024/2956 (Register)

Key requirements:

• Mandatory contractual clauses:
  • Access and audit rights (including for supervisors)
  • Data location and sovereignty
  • Incident notification (2h max)
  • Termination rights and exit strategy
  • Subcontracting control
• ICT provider register: Annual transmission to authorities (first time: 30 April 2025)
• Due diligence before subcontracting + 30-day notification + customer approval
• Limitation of cascading subcontracting (max 2 levels for critical functions)

Dedicated guide: rts-third-party-risk.html

Pillar 5 Information Sharing

DORA Articles: 45-47

RTS/ITS status: No specific RTS (voluntary arrangements)

Key requirements:

• Possibility to establish voluntary arrangements for sharing cyber threat information
• Protection of sensitive and commercial data
• No legal obligation, but strongly encouraged
• Examples: Sectoral ISACs, IOC sharing (Indicators of Compromise)

Documentation: ESA Guidelines (no dedicated RTS)

• Incident Management:
  • Implement classification process (RTS 2024/1772)
  • Create notification templates
  • Obtain access to supervisor portal + eIDAS certificates
  • Train IT/SOC teams on reporting deadlines (4h/72h/1 month)
• ICT Provider Register:
  • List ALL ICT providers
  • Complete register according to ITS 2024/2956 template
  • Submit before 30 April 2025 (ABSOLUTE DEADLINE)
• Governance:
  • Board briefing on DORA obligations
  • Designation of ICT risk management function
  • Validation of ICT risk strategy

• Third-Party Risk Management:
  • Gap analysis of all existing contracts vs. RTS 2024/1773
  • Launch contract renegotiations (critical functions priority)
  • Implement subcontracting approval process (RTS 2025/532)
• ICT Risk Management:
  • Complete ICT asset inventory
  • Classification by criticality
  • First complete risk assessment
  • Documentation of ICT policies compliant with RTS 2024/1774
• BCP/DRP:
  • Review continuity plans
  • Define RTO/RPO
  • Test plans (at least annually)

• Contract Finalization:
  • Complete renegotiations with ALL critical/important providers
  • Migrate to new providers if DORA clauses refused
• Security Controls:
  • Enhanced monitoring (SIEM, logs, alerting)
  • Generalized MFA implementation
  • Improved network segmentation
  • Patch management program
• Audits & Tests:
  • Internal DORA compliance audits
  • Annual pentests
  • BCP/DRP tests

• TLPT (if significant entity):
  • Start planning 18 months before (mid-2026)
  • Selection of TIBER-EU providers (Q3-Q4 2026)
  • Test execution (2027)
  • Completion before 17 January 2028
• Continuous Improvement:
  • Integration of lessons learned from incidents
  • Process optimization
  • Annual review of all DORA elements

1. Pillar-by-Pillar Approach

Don't do everything at once. Prioritize:

1. Pillar 3 (Incidents): Immediate risk if incident occurs from January 2025
2. Pillar 4 (Third-Party): Register deadline 30 April 2025
3. Pillar 1 (Risk Management): Foundation for everything else
4. Pillar 2 (Testing): Longer timeline (TLPT 2028)
5. Pillar 5 (Sharing): Voluntary, consider later

2. Internal Resources

Build a cross-functional team:

• Executive sponsor: Board member (DORA mandatory)
• DORA project leader: Centralized coordination
• CISO / IT Security: Technical aspects
• Compliance / Legal: Regulatory interpretation
• Risk Management: Risk assessments
• IT Operations: Practical implementation
• Procurement: Vendor contract management

3. Budgeting

Ballpark figures for average entity:

• External consultants: €200k – €500k (gap analysis, support)
• Technology tools: €100k – €300k/year (SIEM, GRC platform, monitoring)
• Contract renegotiations: €50k – €200k (legal resources)
• TLPT (if applicable): €150k – €500k every 3 years
• Staff training: €50k – €100k
• TOTAL first year: €500k – €1.5M
• Annual run rate: €200k – €500k

4. Points of Vigilance

• Don't underestimate timelines: Contract renegotiations can take 6–12 months
• Hyperscaler resistance: AWS/Azure/GCP have their own timelines, anticipate
• Exhaustive documentation required: Plan resources for writing/maintenance
• Ongoing operational burden: DORA is not a one-shot project but a permanent change