dora

A DORA gap analysis maps your current controls against obligations in four phases: governance and ICT risk framework (Art. 5–16), incident management (Art. 17–23), resilience testing (Art. 24–27), and third-party risk (Art. 28–30). Output is a table of article, obligation, status, evidence needed, and gap notes.

DORA Art. 19 requires three-stage reporting of major ICT incidents: initial notification within 4 hours of classification as major, an intermediate report within 72 hours, and a final report within 1 month. The clock starts at classification, not detection, and runs 24/7 including weekends.

An incident is major if it meets any single materiality threshold in CDR (EU) 2024/1772 across the Art. 18(1) criteria: clients affected, reputational impact, duration and geographic spread, data losses, criticality of services, and economic impact. The logic is OR, not AND.

DORA is lex specialis for the financial sector under Art. 1, applying to banks, insurers, investment firms, CASPs, and other financial entities. Financial entities subject to DORA are exempt from equivalent NIS2 obligations under NIS2 Art. 4(2); NIS2 applies only where DORA does not.

Art. 30(2) mandates nine provisions for contracts supporting critical or important functions, including data locations, audit and access rights for the entity and competent authorities, termination rights, data portability, and sub-contracting consent. Non-critical arrangements use the lighter Art. 30(3) set.

Yes, but proportionality under Art. 4 allows micro-enterprises and certain small entities to use the simplified ICT risk management framework in Art. 16, with eligibility criteria in CDR (EU) 2024/1774 Chapter II. When eligibility is uncertain, the full Chapter II framework should be applied.