Free tools Windows power users keep installed
One-click scans. No signup required.
DORA is already in force. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector became applicable on January 17, 2025. For an in-scope organization, the task in 2026 is not to finish a one-time certification project, but to operate a documented, tested and continuously improving resilience program.
This nine-step roadmap translates DORA into practical workstreams, accountable owners and evidence. It is a planning guide, not legal advice: scope, exemptions, proportionality, reporting duties and testing obligations must be confirmed against the regulation and applicable supervisory guidance.
As an Amazon Associate I earn from qualifying purchases.
DORA in one minute
DORA harmonizes digital-operational-resilience requirements across much of the EU financial sector. It addresses the risk that a technology failure, cyberattack, cloud outage, supplier failure or data-integrity problem could interrupt critical financial services.
That makes DORA broader than a cybersecurity checklist. Cybersecurity helps prevent unauthorized access and attacks; operational resilience asks whether the organization can continue important services, detect disruption, contain it, recover reliably and learn from the event.
DORA sits alongside, rather than automatically replacing, obligations such as GDPR, NIS2 where applicable, PSD2-related requirements, outsourcing rules and sector-specific expectations from the EBA, EIOPA or ESMA. One incident may trigger several separate notification and evidence duties.
The regulation is part of the EU’s wider Digital Finance Package, which sought a more consistent approach to technology and digital-finance risks than fragmented national requirements could provide.
DORA potentially covers credit institutions, payment and electronic-money institutions, investment firms, insurers and reinsurers, relevant insurance intermediaries, investment-management and fund-related entities, trading venues, other financial-market infrastructure and crypto-asset entities covered by the applicable EU framework. Certain entities may receive simplified treatment or fall within exemptions. Size alone does not establish that an organization is outside scope. Use the legal text and competent-authority guidance for the formal determination.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsICT suppliers also matter. DORA creates an EU-level oversight regime for designated critical ICT third-party service providers, but not every technology vendor is directly designated as critical. A financial entity remains responsible for its own DORA obligations when it outsources technology.
What DORA compliance looks like in practice
In practical terms, an organization should be able to demonstrate that it has an approved ICT-risk-management framework; understands its critical or important business services and dependencies; can handle and recover from ICT incidents; performs applicable resilience testing; reports qualifying incidents; manages ICT suppliers through appropriate contracts and oversight; maintains the required register of information; and gives its management body meaningful visibility into risk, testing and remediation.
Compliance is therefore an evidence problem as well as a controls problem. A policy, backup job or supplier certificate does not prove that the organization can restore a customer-facing service within its recovery objectives.
The 9-step DORA roadmap
1. Confirm scope and applicability
Start with a documented scope assessment rather than assuming that the group, subsidiary or supplier has the same status as another organization.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- List every legal entity operating in the EU.
- Map each entity’s regulated activities and jurisdictions.
- Review group, subsidiary and shared-infrastructure arrangements.
- Assess exemptions and proportionality.
- Identify the relevant competent authority.
- Record which ICT services support critical or important functions.
- Identify suppliers that could fall within critical-ICT-provider oversight, without treating that possibility as a designation.
The first deliverables should be a legal-entity inventory, regulated-activity map, jurisdiction map, scope decision, named executive owner and initial gap-analysis plan. Organizations outside the EU may still need to respond if they operate an EU-regulated financial entity or provide ICT services to one; DORA is not a general law applying to every U.S. company.
2. Map ICT risks, assets and critical services
An asset spreadsheet is not enough. The most useful output is a dependency map connecting each important business service to its applications, infrastructure, data, people, recovery arrangements and suppliers.
Record, as relevant:
- Applications, platforms, networks and cloud environments.
- Data stores, data flows, identity systems and privileged-access systems.
- Endpoints and operational technology.
- Business services and processes.
- Internal support teams and external providers.
- Suppliers, subcontractors, regions and shared dependencies.
- Maximum tolerable disruption, recovery-time objectives and recovery-point objectives.
- Customer, market, regulatory and financial impact if a service is unavailable or data is corrupted.
Classify criticality by business service, not merely by department or server. A service may depend on an identity provider, DNS, certificates, communications, data pipelines and a managed-security provider that are easy to miss when systems are reviewed in isolation.
3. Build the ICT-risk-management framework
DORA expects a lifecycle covering identification, protection and prevention, detection, response and recovery, backup and restoration, and learning and improvement. The framework should include:
- ICT-risk strategy, policies and standards.
- Asset, configuration and dependency management.
- Access control, privileged access and identity protection.
- Change, patch and vulnerability management.
- Encryption and key management.
- Logging, monitoring and detection.
- Secure development and deployment practices.
- Capacity and performance management.
- Backup, restoration and crisis-management procedures.
- Testing, remediation, exceptions and risk acceptance.
DORA generally focuses on appropriate outcomes and controls rather than requiring one particular security product or framework. ISO 27001, SOC 2, NIST CSF or another framework can help organize evidence, but none automatically proves DORA compliance.
4. Prepare incident response and reporting
Build one operational process that can handle the full incident lifecycle:
- Detect and triage the event.
- Classify its type, severity and business impact.
- Determine whether it is ICT-related and reportable under DORA.
- Escalate to accountable executives and the appropriate authority.
- Submit required notifications and subsequent updates.
- Contain the event and restore services.
- Perform root-cause analysis.
- Record lessons learned and corrective actions.
Do not collapse every security alert into a reportable major ICT-related incident. Also keep DORA reporting distinct from GDPR personal-data-breach notification and from payment, contractual or national cyber-reporting duties. Reporting thresholds, templates and timelines depend on the applicable provisions, entity and incident classification; use the current regulation and technical standards rather than relying on a universal deadline.
Maintain an incident-classification matrix, escalation tree, regulator contact list, reporting templates, communications plan, incident tickets, event timeline, post-incident review and corrective-action register. Exercises should demonstrate that these materials work under pressure.
5. Protect and recover critical functions
Resilience requires more than retaining backups. Begin with a business-impact analysis and design recovery around complete services, including their dependencies.
- Set and approve recovery-time and recovery-point objectives.
- Use appropriate redundancy, failover and alternate operating arrangements.
- Protect backups through isolation, access controls and, where appropriate, immutability.
- Define restoration priority and dependency sequencing.
- Prepare manual workarounds and alternate communications.
- Validate data integrity and monitor the environment after recovery.
A successful backup job is not evidence that the business can recover. A recovery plan that restores servers but not identity, networking, DNS, certificates or data dependencies may fail operationally. Cloud redundancy also does not eliminate provider, region, identity or concentration risk. Multi-cloud can still leave an organization dependent on one identity provider, network backbone, backup platform, subcontractor or development pipeline.
6. Govern ICT third-party risk
Supplier oversight should begin before contracting and continue throughout the relationship. Determine whether the service supports a critical or important function, assess the provider’s resilience, understand subcontracting and concentration, and plan for exit.
Review whether arrangements address:
- Security and resilience capabilities.
- Data location, access and retrieval.
- Service levels and measurable recovery objectives.
- Incident notification and cooperation.
- Audit, inspection and testing rights.
- Subcontractor disclosure, approval and control.
- Business continuity and recovery obligations.
- Substitutability, concentration and single-region risk.
- Conflicts of interest.
- Transition, termination and data-portability arrangements.
DORA requires financial entities to maintain and update a register of information covering contractual arrangements for ICT services. Where relevant, information must be maintained at entity, sub-consolidated and consolidated levels. The EBA describes this register as an important supervisory resource for monitoring ICT third-party risk and supporting critical-provider designation.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Ask of every major supplier: Can the firm retrieve its data? Can it transition elsewhere? Are audit rights usable in practice? Are recovery objectives tested? Are subcontractors visible? Is the evidence current and relevant to the actual service?
7. Establish management-body oversight
Operational tasks may sit with IT, security, risk or procurement, but accountability cannot be outsourced to a provider or delegated into a technical dashboard.
The management body should understand:
- The organization’s major ICT risks and risk appetite.
- Critical services and technology dependencies.
- Material supplier and concentration exposures.
- Incident trends, near misses and recovery performance.
- Resilience-test outcomes and unresolved high-risk findings.
- Risk acceptances, investment needs and staffing constraints.
Maintain approvals, meeting minutes, board reporting, training records, internal-audit reports, escalation records and remediation tracking. Meaningful oversight means management can challenge priorities and accept residual risk knowingly, not merely receive technical metrics.
8. Test, audit and document resilience
Testing should be risk-based and connected to real business services. A vulnerability scan cannot substitute for a recovery exercise, and a tabletop cannot prove that production data can be restored.
Depending on the entity and applicable requirements, activities may include vulnerability assessments, network-security assessments, scenario-based exercises, tabletop exercises, continuity tests, disaster-recovery tests, failover and restoration tests, penetration testing, red-team exercises, supplier testing and threat-led penetration testing.
Not every in-scope entity has identical testing obligations or cadence. DORA’s threat-led penetration-testing regime has entity-specific applicability, so confirm the requirement against the regulation and relevant technical standards.
For each test, retain the objective, scope, assumptions, participants, results, findings, severity, corrective action, retest outcome, residual risk and management acceptance. Independent assurance can help, particularly where internal teams designed the controls they are evaluating.
9. Build continuous improvement into the operating model
The ninth step is a culture in which resilience is refreshed rather than filed away. Reassess after major technology changes, acquisitions, migrations, incidents and supplier changes. Review subcontractors, concentration risk, recovery results and recurring near misses. Close findings with evidence, refresh training and update board reporting.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Monitor changes to DORA’s secondary legislation and supervisory expectations. The original Commvault article presented its nine-step framework before DORA’s application date; the framework remains directionally useful, but the practical objective now is ongoing operation and demonstrable improvement, not completion of a past deadline.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.DORA evidence checklist
A regulator, auditor or internal reviewer may expect an organization to produce usable, current and traceable evidence such as:
- Scope assessment and entity inventory.
- ICT-risk strategy, policies and procedures.
- Asset and business-service inventories.
- Dependency and data-flow maps.
- Risk assessments, risk acceptances and exceptions.
- Supplier due diligence, contracts and amendments.
- Subcontractor records and concentration analysis.
- Register-of-information data.
- Incident tickets, classifications, reports and post-incident reviews.
- Business-continuity, crisis-management and recovery plans.
- Backup and restoration test results.
- Resilience, penetration and recovery-test reports.
- Training records, board minutes and management reporting.
- Audit findings, remediation plans and retest evidence.
Each record should have an owner, version, date, requirement mapping and relationship to the relevant system, service or supplier. Protect evidence from unauthorized alteration and keep it available in a format that can actually be reviewed.
A practical readiness matrix
Use a single register with columns for the DORA requirement, business owner, technical owner, current state, gap, required evidence, test method, remediation date, residual risk and board-escalation status. This prevents a common failure mode: controls existing in separate teams but no one being able to demonstrate how they support a critical service.
Common mistakes
- Treating DORA as a cybersecurity purchasing exercise.
- Assuming an ISO 27001 certificate, SOC 2 report or NIST implementation automatically proves compliance.
- Failing to inventory subcontractors and shared dependencies.
- Maintaining supplier contracts without a reliable register of information.
- Testing isolated systems instead of end-to-end services.
- Calling a successful backup job a successful recovery.
- Giving the board technical metrics without customer or business impact.
- Ignoring exit plans and provider concentration.
- Confusing DORA, GDPR and payment-incident reporting.
- Assuming the January 17, 2025 application date ended the work.
- Claiming that a product is “DORA-certified” without a specific, authoritative certification.
DORA alongside related obligations
| Regime | Primary focus | Practical implication |
|---|---|---|
| DORA | Digital operational resilience in financial services | ICT risk, incidents, testing, recovery, governance and ICT suppliers. |
| GDPR | Personal-data protection | A technology incident involving personal data may create separate breach, security and accountability duties. |
| NIS2 | Cybersecurity and risk management for covered sectors and entities | May overlap with DORA, but DORA can operate as the sector-specific framework for covered financial entities. |
| PSD2 and payment rules | Payment services and related security or incident duties | Payment organizations should map distinct reporting and operational requirements rather than assume one notification satisfies all regimes. |
| Sector and national rules | Supervisory and outsourcing expectations | Check EBA, EIOPA, ESMA and competent-authority requirements applicable to the entity. |
Choosing technology and service providers
No software platform makes an organization DORA-compliant by itself. Tools can help collect evidence, manage suppliers, track risks, coordinate incidents, test controls or improve recovery, but the financial entity remains responsible for its governance, decisions, controls, testing and reporting.
Organizations may evaluate several categories:
- Backup and cyber recovery: such as Commvault Cloud, for data protection, restoration and recovery evidence. This does not replace governance, supplier-risk, incident-reporting or register-of-information processes.
- GRC and risk platforms: including ServiceNow IRM, OneTrust GRC, Archer and IBM OpenPages, for control mapping, risk, audit evidence and remediation.
- Third-party-risk tools: including OneTrust TPRM, ServiceNow Vendor Risk Management and Archer Third Party Governance.
- Evidence and compliance automation: such as Vanta, Drata and Secureframe. Confirm the depth of support for ICT dependencies, incident reporting, resilience testing and supplier registers rather than assuming a framework crosswalk is sufficient.
- Advisory and testing: for applicability reviews, gap assessments, register implementation, contract remediation, recovery exercises, penetration testing and independent assurance.
Compare providers on DORA requirement mapping, register support, subcontractor coverage, integrations, evidence retention, EU hosting and data residency, access controls, exports, group-level views, implementation support, portability and total cost of ownership. Distinguish actual product capabilities from legal-compliance promises. Pricing for the products and services above is generally quote-led and should be confirmed directly.
The original nine-step explainer was published by Commvault on September 27, 2024 and has a commercial interest in presenting its cyber-recovery capabilities. Commvault may be relevant to the backup and recovery portion of a program, but it is not a universal solution for every DORA obligation.
30-, 90- and 180-day implementation framework
These are planning intervals, not statutory DORA deadlines.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
First 30 days
- Confirm scope and assign executive ownership.
- Inventory critical services and major ICT suppliers.
- Establish the gap and evidence registers.
- Identify undocumented high-risk changes and apply appropriate governance.
By 90 days
- Complete priority dependency mapping.
- Approve ICT-risk policies and incident procedures.
- Create incident-classification and escalation workflows.
- Begin contract remediation and build the register of information.
- Test priority recovery scenarios.
By 180 days
- Complete broader resilience testing.
- Close high-severity gaps or document approved residual risk.
- Validate reporting workflows through an exercise.
- Run a board-level scenario exercise.
- Obtain independent assurance where appropriate.
- Set recurring review, testing and improvement cycles.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
