# Dora compliance assessment
> Source: https://legalcode.md/skills/legalcode-dora-compliance-assessment | [HTML version](https://legalcode.md/skills/legalcode-dora-compliance-assessment)

Assesses EU DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance for financial entities covering all five DORA pillars: ICT risk…

Assesses EU DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance for financial entities covering all five DORA pillars: ICT risk management framework (Chapter II, Articles 5–16); ICT-related incident classification and reporting (Chapter III, Articles 17–23); digital operational resilience testing including Threat-Led Penetration Testing — TLPT (Chapter IV, Articles 24–27); third-party ICT risk management including critical ICT third-party service providers — CTPPs (Chapter V, Articles 28–44); and information sharing arrangements (Chapter VI, Article 45). Maps DORA to NIS2 Directive lex specialis, GDPR Article 32, EBA guidelines, and all 27 finalized regulatory and implementing technical standards (RTS/ITS). Use when a financial entity needs to assess DORA compliance posture, prepare for supervisory examination, build a DORA gap remediation roadmap, design incident classification and reporting procedures, prepare TLPT programs, audit third-party ICT contracts for Article 30 mandatory provisions, or build information sharing arrangements. Covers entity scope determination (21 in-scope categories including credit institutions, investment firms, payment institutions, insurers, crypto-asset service providers), simplified regime entities (Article 16), board governance requirements (Article 5), TLPT mandatory 3-year testing cycle, register of contractual arrangements, CTPP oversight exposure, and cross-directive alignment. Produces COMPLIANT/PARTIAL/NON-COMPLIANT/CRITICAL compliance assessments per pillar with IMMEDIATE/NEAR-TERM/BACKGROUND remediation roadmaps, prioritised action tables, and Glass Box audit trail.

This skill assesses an organisation's compliance posture against the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554, applied from 17 January 2025). It covers the full DORA obligation stack across five pillars: ICT risk management, incident classification and reporting, digital operational resilience testing (TLPT), third-party ICT risk management, and information sharing. **Covers:** - Entity scope determination — all 21 in-scope financial entity categories and exclusions - Simplified regime applicability (Article 16) for qualifying microenterprises and small entities - **Pillar 1**: ICT Risk Management Framework — governance (Article 5), strategy (Articles 6–7), identification (Article 8), protection (Article 9), detection (Article 10), response and recovery (Article 11), backup and restoration (Article 12), learning and evolving (Article 13), communication (Article 14), and audit requirements - **Pillar 2**: ICT Incident Classification and Reporting — major incident classification criteria (Article 18 + Commission Delegated Regulation (EU) 2024/1772), reporting timelines (Articles 19–20 + Commission Delegated Regulation (EU) 2025/301 + Implementing Regulation (EU) 2025/302), voluntary notification and cyber threat sharing (Article 20) - **Pillar 3**: Digital Operational Resilience Testing — basic testing programme (Article 25), TLPT mandatory testing scope, methodology, frequency, and external tester requirements (Article 26 + Commission Delegated Regulation (EU) 2025/1190), TIBER-EU alignment - **Pillar ...

## Jurisdictions

Global



---
*Legalcode -- legalcode.md*