DORA operating workspace | Compliancify

Official Regulation (EU) 2022/2554

Delegated and implementing acts plus supervisory materials may apply

Entity, service, proportionality, national, and group context require qualified review

DORA has applied since 17 January 2025, but entity scope, proportionality, ICT service classification, reporting, registers, contractual requirements, and supervisory expectations require current-source and professional assessment.

Official starting point: https://eur-lex.europa.eu/eli/reg/2022/2554/oj

ICT risk management — Govern strategy, roles, framework, asset and dependency context, protection, detection, response, recovery, learning, and reporting.

ICT incident classification & reporting — Classify ICT incidents, preserve facts and timing, route reporting thresholds, approvals, communications, and follow-up.

Operational resilience testing — Maintain risk-based test scope, cadence, scenarios, independence, defects, remediation, validation, and advanced-testing decisions.

Third-party register — Maintain ICT service, provider, entity, function, criticality, subcontractor, location, contract, dependency, and exit context.

Contractual provisions & exit — Assess required contract terms, service levels, access, audit, incident support, data, subcontracting, termination, and exit plans.

Oversight & remediation — Route board oversight, risk acceptance, material issues, supervisory requests, remediation, closure, and recurring review.

ICT risk management: Framework, policies, inventories, risk assessments, board reporting, incidents, tests, and improvements. Owner: ICT risk owner. Reviewer: Risk governance reviewer. State: Mapped.

ICT incident classification & reporting: Incident record, classification rationale, timeline, impact, notification decision, submission record, and remediation. Owner: Incident owner. Reviewer: Regulatory reporting reviewer. State: Review due.

Operational resilience testing: Test strategy, plans, scenarios, execution, results, defects, remediation, retest, and governance approval. Owner: Resilience testing owner. Reviewer: Independent test reviewer. State: Evidence ready.

Third-party register: Register, service taxonomy, contracts, risk assessments, concentration analysis, changes, and ownership review. Owner: Vendor owner. Reviewer: Third-party risk reviewer. State: Review due.

Contractual provisions & exit: Clause assessment, contract, addenda, approvals, exceptions, monitoring, termination rights, and exit test. Owner: Contract owner. Reviewer: Legal reviewer. State: Interpretation pending.

Oversight & remediation: Governance packs, decisions, issues, supervisory correspondence, action evidence, validation, and closure approval. Owner: Operational resilience owner. Reviewer: Executive risk reviewer. State: Reviewer decision.

NIS2 operational and incident context

ISO/IEC 27001 management system

NIST CSF 2.0 resilience outcomes