DORA RTS and ITS: The Complete List of Technical Standards

DORA’s Level 1 text is implemented through a package of RTS and ITS drafted by the European Supervisory Authorities. Programmes fail when teams stop at the Regulation and ignore the technical standards supervisors actually examine against.

Related: DORA hub · Incident clocks · Register.

How to use this page: Treat it as a navigation map by theme (ICT risk, incident reporting, testing, third-party / register, oversight). Always verify the current Official Journal / ESA publication list before citing a specific RTS/ITS number in policies — the package evolves.

Standard Themes

ICT risk management — detailed control and framework expectations
Incident classification & reporting — including content and timelines (e.g. Delegated Regulation (EU) 2025/301 themes for major ICT-related incident reports)
TLPT — advanced testing requirements
Register of information / contractual themes — third-party data and key provisions
CTPP oversight — criteria and oversight processes for critical providers

Operating Tip

Maintain an internal register of “which RTS/ITS we implement” with owners and last-reviewed dates. Link each to evidence folders in CSA.

Primary Sources

Prefer EUR-Lex Official Journal texts and the joint ESA / EBA–EIOPA–ESMA DORA pages over secondary summaries when updating board packs.

How CyberSilo Helps

Pillar-by-pillar evidence maps in CSA for DORA
Detection and major-incident timelines with ThreatHawk SIEM
Advisory scoping — contact CyberSilo

Map RTS/ITS to Evidence Owners

Use CSA to attach each technical standard theme to control evidence and owners.

Talk to CyberSilo DORA Hub

Frequently Asked Questions

What is an RTS vs an ITS?

Regulatory Technical Standards specify technical detail of obligations; Implementing Technical Standards often specify formats, templates, and procedures. Both bind once adopted.

Do RTS replace the Regulation?

No. They implement and detail Regulation (EU) 2022/2554. You need both Level 1 and Level 2 texts.

Where do incident clocks live?

Detailed reporting timelines and content for major ICT-related incidents are set out in the delegated reporting standards — see our incident reporting deadlines page referencing Delegated Regulation (EU) 2025/301 themes.

Hub · Pillars · What is DORA?

DORA RTS and ITS: The Complete List of Technical Standards

Standard Themes

Operating Tip

Primary Sources