DORA Compliance Checklist

Use this checklist as a programme board — not as a certification claim. Tick items only when evidence exists, not when a policy PDF exists.

Related: DORA hub · Five pillars · CSA.

How to score: For each item, record owner, evidence location, and last test/review date. Prefer living artefacts (register extracts, incident drills, TLPT remediation trackers) over undated policies.

Governance & ICT Risk (Arts 5–16)

Management-body approved ICT risk management framework
ICT asset & dependency inventory (Art. 8 themes)
Protection / vulnerability / change controls (Art. 9)
Detection & logging capability (Art. 10) — guide
Response, recovery, backup strategies with entity-set RTO/RPO
Post-incident learning process

Incident Reporting

Classification criteria for major ICT-related incidents
Playbooks for initial (4h / ≤24h), intermediate (72h), final (1 month)
Authority contact list and template pack

Testing

Risk-based testing plan for the year
TLPT scoping if significant — TLPT

Third-Party

Register of information current — template
Article 30 contract schedule for critical/important ICT services
Concentration / exit plans for key providers

Decision on participation in trusted cyber-threat sharing communities

How CyberSilo Helps

Pillar-by-pillar evidence maps in CSA for DORA
Detection and major-incident timelines with ThreatHawk SIEM
Advisory scoping — contact CyberSilo

Turn the Checklist into Tracked Evidence

Load checklist items into CSA with owners and proof links.

Talk to CyberSilo DORA Hub

Frequently Asked Questions

Is this an official ESA checklist?

No. It is a practical CyberSilo programme outline aligned to the five pillars and common examination themes.

Do microenterprises use the same list?

Simplified ICT risk management may apply to certain microenterprises — confirm Article 16 themes and exclusions with counsel.

How often should we re-run the checklist?

At least quarterly for register and incident readiness; deeper annual review before management-body approval of the ICT risk framework.

Hub · What is DORA? · CSA

DORA Compliance Checklist

Governance & ICT Risk (Arts 5–16)

Incident Reporting

Testing

Third-Party