DORA RTS and ITS: The Complete List of Technical Standards

Standard Themes

• ICT risk management — detailed control and framework expectations
• Incident classification & reporting — including content and timelines (e.g. Delegated Regulation (EU) 2025/301 themes for major ICT-related incident reports)
• TLPT — advanced testing requirements
• Register of information / contractual themes — third-party data and key provisions
• CTPP oversight — criteria and oversight processes for critical providers

Operating Tip

Maintain an internal register of “which RTS/ITS we implement” with owners and last-reviewed dates. Link each to evidence folders in CSA.

Primary Sources

Prefer EUR-Lex Official Journal texts and the joint ESA / EBA–EIOPA–ESMA DORA pages over secondary summaries when updating board packs.

How CyberSilo Helps

• Pillar-by-pillar evidence maps in CSA for DORA
• Detection and major-incident timelines with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

What is an RTS vs an ITS?

Regulatory Technical Standards specify technical detail of obligations; Implementing Technical Standards often specify formats, templates, and procedures. Both bind once adopted.

Do RTS replace the Regulation?

No. They implement and detail Regulation (EU) 2022/2554. You need both Level 1 and Level 2 texts.

Where do incident clocks live?

Detailed reporting timelines and content for major ICT-related incidents are set out in the delegated reporting standards — see our incident reporting deadlines page referencing Delegated Regulation (EU) 2025/301 themes.

Related DORA Resources

Hub · Pillars · What is DORA?