Comprehensive guide to DORA's Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS). Download the complete PDF documentation and understand all compliance requirements.
Get instant access to all 6 Regulatory Technical Standards & Implementing Technical Standards documents
Secure payment via Stripe. Instant delivery by email.
The Digital Operational Resilience Act (DORA) is supplemented by detailed Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS) developed by the European Supervisory Authorities (ESAs) - EBA, EIOPA, and ESMA.
RTS (Regulatory Technical Standards): Define detailed technical requirements and regulatory standards that financial entities must comply with.
ITS (Implementing Technical Standards): Provide practical implementation details, templates, and formats for reporting and compliance.
January 17, 2025: DORA regulation becomes fully applicable across all EU member states. Financial entities must comply with all RTS and ITS requirements.
DORA Entry into Force: Regulation (EU) 2022/2554 entered into force, giving entities 24 months to prepare.
RTS & ITS Development: ESAs developed and finalized technical standards through public consultations.
Final RTS Adoption: European Commission adopted final RTS packages covering all DORA pillars.
Full Application: All DORA requirements, including RTS and ITS, become fully applicable.
| Requirement Area | Key Provisions |
|---|---|
| Governance | Management body responsibilities, ICT risk management function, three lines of defense |
| Risk Assessment | Comprehensive ICT risk assessment at least annually, documenting critical/important functions |
| Protection & Prevention | Security policies, access controls, change management, network security |
| Detection | Continuous monitoring, anomaly detection, logging and correlation mechanisms |
| Response & Recovery | Business continuity plans, disaster recovery, backup strategies, crisis communication |
Financial entities must classify ICT-related incidents based on specific criteria:
Incidents are classified as "major" based on:
Access the full RTS on Incident Reporting with detailed timelines, requirements, and compliance checklists. Included in the RTS/ITS package.
Advanced testing framework for entities identified as significant:
Detailed requirements for managing ICT third-party service providers:
| Stage | Requirements |
|---|---|
| Pre-Contracting | Due diligence, risk assessment, alternative provider analysis |
| Contractual | Mandatory contract clauses, SLAs, audit rights, termination rights, data access |
| Monitoring | Continuous oversight, performance monitoring, incident reporting from providers |
| Exit | Exit strategies, transition plans, data retrieval procedures |
Access authoritative sources for DORA technical standards:
Implementing DORA RTS requirements can be complex. Our experts can help you:
Identify gaps between your current state and DORA RTS requirements
Develop a structured implementation plan with timelines and priorities
Create compliant policies, procedures, and documentation
Train your teams on DORA RTS requirements and best practices
All 13 Regulatory and Implementing Technical Standards for DORA in one searchable reference
Complete TLPT pillar page — who must test, TIBER-EU alignment, phases, scope requirements
Complete TLPT framework — scope, methodology, and reporting templates from the RTS text
4-hour, 72-hour, and final report timelines with decision trees and classification criteria
Deep-dive comparing Regulatory and Implementing Technical Standards under DORA
Recent amendments and updates to DORA Technical Standards from ESAs
Take our free 5-minute assessment to evaluate your DORA readiness
Sector-specific guidance for banking institutions
50+ expert answers on compliance, deadlines and penalties
Both frameworks apply to many financial entities — lex specialis rule, dual compliance obligations, and where DORA takes precedence
Complete guide to the Register of Information, Article 30 mandatory clauses, the 19 designated CTPPs, and the due diligence framework
Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.