DORA
DORA, part by part.
Eurus reads DORA from the Regulation and its delegated acts: whether it applies, the register of information, and the classification and reports of a major ICT-related incident. Each answer names its article.
What DORA asks
DORA has applied since 17 January 2025 to the financial entities listed in its Article 2(1). It has five main parts.
ICT risk management (Articles 5 to 16)
A framework for ICT risk that the management body defines, approves and oversees, and is responsible for (Article 5). The smaller entities named in Article 16 keep a simplified framework.
Incidents (Articles 17 to 23)
A process to detect, manage and record ICT-related incidents, classification against the criteria of Delegated Regulation (EU) 2024/1772, and reports of each major incident to the competent authority.
Resilience testing (Articles 24 to 27)
A testing programme for ICT systems and tools. The entities the competent authority identifies also carry out threat-led penetration testing at least every three years (Article 26).
ICT third-party risk (Articles 28 to 44)
A strategy for ICT third-party risk, a register of information on every contract for ICT services, the contract terms of Article 30, and exit strategies. The European Supervisory Authorities oversee the ICT providers designated as critical.
Information sharing (Article 45)
Financial entities may share cyber threat information and intelligence among themselves, in trusted communities.
In Ireland
The Central Bank of Ireland
For the financial entities it supervises, the Central Bank of Ireland is the competent authority. Major incident reports and the register of information go to it.
ICT suppliers
An ICT supplier to banks, insurers, payment firms or fund managers meets DORA through its customers' contracts: Article 30's terms, the questions for their registers, and prompt word of an incident.
Try this in a copy of your own, for two hours, with nothing to sign up for.
Open your own copyWhat Eurus keeps
Four of DORA's duties are kept in the software, each with the article it rests on.
Whether it applies
The scoping questions read Article 2(1)'s entity types, Article 2(3)'s exclusions and Article 16's simplified framework. The verdict names its provision.
The register of information
Kept in the columns of Implementing Regulation (EU) 2024/2956, with what is missing listed by column, and exported as one file for each template.
Major or not
A person answers the criteria of Delegated Regulation (EU) 2024/1772. The result names the thresholds met and what is still unknown.
The reporting clocks
The initial notification, the intermediate report and the final report, each dated from the one before.
Want it on your own systems?
We start with an audit: how your operations really run, mapped to the controls you keep.