🏦
Art. 5–16
ICT Risk Management
Governance, risk frameworks, asset inventory, and business continuity integration per Art. 5–16.
Q1 · Pillar 1
A formally documented ICT Risk Management Framework exists and is approved at board level?
Q2 · Pillar 1
A board-approved ICT risk appetite statement is defined and reviewed at least annually?
Q3 · Pillar 1
Business Continuity Management (BCM) is integrated with your ICT resilience strategy?
Q4 · Pillar 1
A comprehensive ICT asset inventory with criticality ratings is maintained?
Q5 · Pillar 1
An annual ICT risk assessment covering threat identification and impact analysis is conducted?
🚨
Art. 17–23
ICT Incident Management
Detection, classification, reporting timelines, and post-incident review per Art. 17–23.
Q1 · Pillar 2
Incident classification criteria aligned to DORA Art. 18 severity thresholds are formally defined?
Q2 · Pillar 2
24/7 ICT incident detection and monitoring capabilities are in place?
Q3 · Pillar 2
Incident reporting SLAs meet DORA timelines (4h initial / 72h intermediate / 1 month final)?
Q4 · Pillar 2
A formal post-incident review process producing lessons-learned reports exists?
Q5 · Pillar 2
DORA-aligned severity classification has been applied to all recent ICT incidents?
🔬
Art. 24–27
Resilience Testing (TLPT)
Annual testing programme, TLPT scope, DAST/SAST, and test-to-risk feedback per Art. 24–27.
Q1 · Pillar 3
An annual Digital Operational Resilience Testing programme covering Art. 24 basic testing exists?
Q2 · Pillar 3
The scope of Threat-Led Penetration Testing (TLPT) for critical functions is formally defined?
Q3 · Pillar 3
Internal audit of resilience controls against the DORA testing requirements is conducted?
Q4 · Pillar 3
DAST/SAST security testing is integrated into the software development lifecycle?
Q5 · Pillar 3
Resilience test results are systematically fed back into the ICT risk management framework?
🔗
Art. 28–44
Third-Party Risk
TPP register, concentration risk, Art. 30 contractual clauses, and exit strategies per Art. 28–44.
Q1 · Pillar 4
A register of all critical and important ICT third-party providers (TPPs) is maintained?
Q2 · Pillar 4
ICT TPP concentration risk (single points of failure) is formally assessed?
Q3 · Pillar 4
Exit strategies and transition plans for critical ICT TPPs are documented?
Q4 · Pillar 4
All ICT outsourcing contracts include the mandatory Art. 30 contractual clauses?
Q5 · Pillar 4
Sub-outsourcing arrangements of critical TPPs are monitored and approved?
📡
Art. 45–49
Intelligence Sharing
ISAC membership, TLP-aligned dissemination, and intelligence integration per Art. 45–49.
Q1 · Pillar 5
Formal cyber threat intelligence sharing arrangements with sector peers/ISACs are established?
Q2 · Pillar 5
Your organisation is a member of a relevant sector ISAC or threat sharing community?
Q3 · Pillar 5
TLP-compliant processes for receiving and disseminating threat intelligence are implemented?
Q4 · Pillar 5
Threat intelligence is systematically integrated into the ICT risk assessment process?
Q5 · Pillar 5
Voluntary reporting of significant cyber threats to the competent authority has been considered?