DORA Certifications Bundle
399 € excl. VAT
Commission Delegated Regulation (EU) 2024/1774
Digital Operational Resilience Act (DORA)
Objective: This RTS establishes the regulatory technical standards specifying the ICT risk management tools, methods, processes and policies, as well as the simplified ICT risk management framework for small financial entities.
Article 3 - Roles and Responsibilities:
Article 4 - Asset Inventory:
Article 5 - Assessment Methodology:
| Domain | Key Requirements |
|---|---|
| Access Control |
• Multi-factor authentication (MFA) • Principle of least privilege • Periodic review of access rights • Logging of privileged access |
| Cryptography |
• Encryption of sensitive data at rest • Encryption of communications (TLS 1.2+) • Secure management of cryptographic keys • Use of approved algorithms |
| Vulnerability Management |
• Regular vulnerability scanning • Patch management within required timeframes • Annual penetration testing minimum • Monitoring of emerging threats |
| Network Security |
• Network segmentation • Firewalls and intrusion detection systems • Network traffic monitoring • DDoS protection |
Mandatory components of the BCP/DRP policy:
Documentation requirements:
Mandatory testing:
| Monitoring Type | Frequency | Key Metrics |
|---|---|---|
| System availability | Real-time | Uptime, response time, latency |
| Security events | Real-time | Intrusion attempts, anomalies, SIEM alerts |
| Performance | Continuous | CPU, memory, storage, bandwidth |
| Control compliance | Quarterly | Compliance rate, exceptions, deviations |
Mandatory reports:
Report content:
Entities eligible for the simplified framework:
Authorized simplifications:
⚠ Requirements maintained despite simplification:
| Step | Required Actions | Priority |
|---|---|---|
| 1. Governance |
☐ Designate ICT risk management function ☐ Define roles and responsibilities ☐ Establish ICT risk strategy ☐ Obtain management body approval |
HIGH |
| 2. Inventory |
☐ Inventory all ICT assets ☐ Classify by criticality ☐ Identify interdependencies ☐ Update inventory |
HIGH |
| 3. Risk Assessment |
☐ Choose assessment methodology ☐ Conduct initial assessment ☐ Document identified risks ☐ Define treatment plans |
HIGH |
| 4. Security Controls |
☐ Implement MFA ☐ Data encryption ☐ Network segmentation ☐ Security monitoring (SIEM) |
MEDIUM |
| 5. Continuity |
☐ Perform BIA (Business Impact Analysis) ☐ Define RTO/RPO ☐ Write BCP/DRP plans ☐ Test the plans |
HIGH |
| 6. Documentation |
☐ Comprehensive ICT policies ☐ Operational procedures ☐ Registers and logs ☐ Evidence of compliance |
MEDIUM |
| 7. Testing and Audits |
☐ Vulnerability testing ☐ Penetration testing ☐ Internal audits ☐ Compliance review |
MEDIUM |
| 8. Reporting |
☐ Establish KRIs/KPIs ☐ Monitoring dashboards ☐ Quarterly reports ☐ Annual review |
NORMAL |
Our experts can guide your institution through DORA compliance, from gap analysis to full implementation.
Workbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.
Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.