A practical checklist for EU financial entities and their ICT providers under the Digital Operational Resilience Act, in force since January 2025.
The checklist
- Confirm you're in scope — most EU financial entities, plus ICT third-party providers deemed critical.
- Stand up an ICT risk management framework owned and approved by the management body.
- Inventory and classify your ICT assets, systems and their dependencies.
- Build ICT incident management — detect, classify, and report major incidents to your competent authority within the required windows.
- Run a resilience testing programme — including threat-led penetration testing (TLPT) for significant entities.
- Manage ICT third-party risk — maintain a register of information and bring contracts up to DORA's requirements.
- Prepare for oversight of critical ICT third-party providers.
- Set up information sharing of cyber-threat intelligence (voluntary).
- Evidence governance — board-level accountability for digital operational resilience.
Residency, by designDORA expects you to know exactly where your data and providers sit. A sovereign, EU-resident deployment keeps your evidence and dependencies inside your jurisdiction — not in a third-party cloud abroad.
A practical starting checklist, not legal advice. Confirm your obligations with your competent authority and legal counsel.