DORA Compliance Tracker

DORA Compliance — Tracked, Evidenced, Board-Ready

DORA creates five pillars of operational resilience obligations: ICT risk management, incident reporting, digital resilience testing, ICT third-party risk management, and information sharing. Each pillar requires ongoing documentation, testing, and governance. Our tracker monitors all five continuously — with the RoI mapping as the centrepiece.

• ICT Risk Management Framework: DORA-aligned risk register, control mapping, and gap analysis across all five pillars
• Register of Information (RoI) Builder: Map all ICT third-party providers, classify by criticality, and generate the RoI in the format ESAs require — critical for the March 2026 submission
• ICT Incident Classification: Determine which incidents qualify as major ICT incidents and which trigger regulatory reporting — with 4-hour initial notification template
• TLPT Readiness (Threat-Led Penetration Testing): For in-scope significant entities — testing framework, vendor selection criteria, and result integration
• Third-Party ICT Risk Assessment: Standardised due diligence questionnaire for ICT providers, contractual requirement checklist, and exit strategy documentation
• Board Reporting: Quarterly DORA governance report for management body — fulfilling Art. 5 board oversight duties
• UK/EU Dual Mapping: For firms operating under both FCA Operational Resilience Policy and DORA — avoid duplicating work
• Monthly RoI Update: Third-party register changes tracked automatically — always submission-ready

⚠️ Legal disclaimer (COMPLIANCE): This product is provided for information and compliance documentation only; it is not regulatory advice. Read the full disclaimer below or in our Terms of Service before purchase.

Cyber Essentials 2026 Cross-Mapping

DORA Chapter II ICT risk management requirements overlap with CE 2026 controls — this tracker maintains both maps in one view:

• Firewalls — DORA Article 9 network segmentation requirements cross-mapped to CE perimeter controls
• Secure configuration — DORA Article 9 configuration management + CIS-benchmark hardening evidence
• User access control + MFA mandate — DORA Article 9 identity & access management + CE 2026 MFA mandate (28 April 2026); RBAC and least-privilege evidence
• Malware protection — DORA Article 9 ICT operations + endpoint protection / EDR coverage
• Security update management — DORA Article 9 vulnerability management + CE 2026 patch management cadence