Does DORA apply to you? Scope, five pillars and readiness gaps
Answer 10–30 short questions. You get your likely DORA status with the reasoning, the pillars that apply, your readiness by pillar and the register-of-information tasks. Built for financial entities, fintechs and the ICT companies that serve them.
Start the checkRules as of 2026-10-13
Preliminary, not legal adviceThis tool applies Regulation (EU) 2022/2554 as we read it to your answers. It does not replace your legal counsel or your competent authority, and it does not assess specific providers. The rules are still being checked by a lawyer, so treat every result as a starting point.
The five pillars of DORA in plain words
ICT risk management
Chapter II, Art. 5–16A documented framework, approved and owned by the management body: know your ICT assets, protect them, detect problems, respond, recover and learn.
Incident management and reporting
Chapter III, Art. 17–23One process for ICT incidents, criteria to spot major ones, and initial, intermediate and final reports to your supervisor on fixed timelines.
Resilience testing
Chapter IV, Art. 24–27A testing programme for critical systems every year; selected entities also run threat-led penetration tests (TLPT) at least every three years.
ICT third-party risk
Chapter V, Art. 28–44A strategy for ICT providers, a register of information on every ICT contract, Article 30 clauses, exit plans and EU oversight of critical providers.
Information sharing
Chapter VI, Art. 45Voluntary arrangements to exchange cyber-threat intelligence with peers, with notice to your authority.
Register of information: what it is
The register of information lists every contract your organisation has for ICT services: who the provider is, what the service is, which business functions depend on it, where data is processed and which subcontractors stand behind it.
Financial entities keep it at entity level and, in groups, at sub-consolidated and consolidated level. Supervisors collect it on their own schedule using the templates of Implementing Regulation (EU) 2024/2956. It is usually the first thing they ask for.
For ICT providers: what your bank customers will ask
DORA does not license ICT providers, but it changes every contract they sign with banks, insurers, payment and investment firms. Expect a DORA addendum with the Article 30 clauses, questionnaires for your client’s register of information, audit and access rights, incident notification timelines and, for critical functions, participation in their resilience tests.
Providers that many financial entities depend on can be designated critical by the European Supervisory Authorities and are then overseen directly at EU level.
What this tool does not cover
- TLPT details and national TLPT frameworks
- National laws, supervisory guidance and reporting schedules of your country
- MiCA, PSD2 and other sector-specific requirements
- An assessment of your specific ICT providers or contracts
- Whether DORA applies to a particular contract — that needs your contract and counsel
Sources
Rules version 2026-10-13. Every article, list and deadline is pending legal review.
| Source | What it covers | Checked |
|---|---|---|
| DORA | Regulation (EU) 2022/2554 (DORA) | — |
| RTS ICT | Commission Delegated Regulation (EU) 2024/1774 — ICT risk management framework and simplified framework (RTS) | — |
| ROI ITS | Commission Implementing Regulation (EU) 2024/2956 — register of information templates (ITS) | — |
| RTS INC | Commission Delegated Regulation (EU) 2024/1772 — classification of ICT-related incidents (RTS) | — |
| ESAS CTPP | European Supervisory Authorities — DORA oversight of critical ICT third-party providers | — |
FAQ
Does DORA apply to my company?
DORA applies to the 20 types of financial entities listed in Article 2(1) — banks, payment and e-money institutions, investment firms, crypto-asset service providers, insurers, pension funds and others — unless an Article 2(3) exclusion applies. ICT providers are reached through their financial clients’ contracts. This checker gives a preliminary answer in a few minutes.
Which entities are in scope of DORA?
Credit institutions, payment institutions, account information service providers, e-money institutions, investment firms, crypto-asset service providers and issuers of asset-referenced tokens, central securities depositories, central counterparties, trading venues, trade repositories, AIFMs, UCITS management companies, data reporting service providers, insurers and reinsurers, insurance intermediaries, IORPs, credit rating agencies, administrators of critical benchmarks, crowdfunding service providers, securitisation repositories, plus ICT third-party service providers.
What are the five pillars of DORA?
ICT risk management, ICT incident management and reporting, digital operational resilience testing, ICT third-party risk management, and information sharing on cyber threats.
What is the DORA register of information and who must keep it?
It is a structured list of all contractual arrangements for ICT services. Every financial entity in scope keeps it, at entity level and, for groups, at sub-consolidated and consolidated level, and submits it to its competent authority on request.
Does DORA apply to software vendors and cloud providers serving banks?
Not as a licence, but through contracts: banks and other financial entities must include the Article 30 clauses in their ICT contracts and check their providers. Providers that many financial entities depend on can be designated critical and overseen at EU level.
What are the DORA incident reporting deadlines?
For major ICT incidents the technical standards set an initial notification within hours of classifying the incident as major, an intermediate report within days and a final report within about a month. The exact timelines are in the implementing acts and are pending legal review in this tool.
How does DORA relate to NIS2?
For financial entities DORA is the specific act (lex specialis): its ICT risk and incident rules apply instead of the NIS2 cybersecurity requirements. Non-financial activities of the same group may still fall under NIS2.
Can YuSMP help with a DORA gap assessment?
Yes. We help financial entities and ICT providers build the register of information, remediate contracts, set up incident processes and run resilience testing. We work under an NDA.
Related services
Penetration testing and security audits
Vulnerability assessments and pentests for your resilience testing programme.
Cloud and DevOps
Backups, recovery, monitoring and infrastructure as code with evidence.
Enterprise software development
Registers, workflows and integrations for compliance teams.
SOC 2 readiness for SaaS
Controls and evidence your financial clients ask for.