DORA (Regulation (EU) 2022/2554): the evidence behind each requirement

24 articles. For each, the artefacts auditors commonly ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

Applies to the financial entities listed in Article 2. Many duties are lighter or absent for microenterprises and for the entities in Article 16(1); each statement says where. Article 19 carries the reporting clocks of Delegated Regulation (EU) 2025/301, Article 5.

DORA Chapter II: ICT Risk Management

Art.5Governance and organisation hard Art.6ICT risk management framework hard Art.7ICT systems, protocols and tools moderate Art.8Identification hard Art.9Protection and prevention hard Art.10Detection easy Art.11Response and recovery hard Art.12Backup policies and procedures, restoration and recovery hard Art.13Learning and evolving hard Art.14Communication hard Art.16Simplified ICT risk management framework hard

DORA Chapter III: ICT-Related Incident Management

DORA Chapter IV: Digital Operational Resilience Testing

Art.24General requirements for the performance of digital operational resilience testing hard Art.25Testing of ICT tools and systems moderate Art.26Advanced testing of ICT tools, systems and processes based on TLPT hard Art.27Requirements for testers for the carrying out of TLPT hard

DORA Chapter V: ICT Third-Party Risk Management

Art.28ICT third-party risk: general principles hard Art.29Preliminary assessment of ICT concentration risk at entity level hard Art.30Key contractual provisions hard Art.31Designation of critical ICT third-party service providers hard

DORA Chapters VI-VII: Information Sharing, Penalties and Data Protection

Art.45Information-sharing arrangements on cyber threat information and intelligence moderate