DORA: the evidence behind every control

26 controls. For each, the artefacts auditors ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

DORA Chapter II: ICT Risk Management

Art.5Governance and organisation hard Art.6ICT risk management framework hard Art.7ICT systems, protocols and tools hard Art.8Identification hard Art.9Protection and prevention hard Art.10Detection easy Art.11Response and recovery hard Art.12Backup policies and procedures, restoration and recovery hard Art.13Learning and evolving hard Art.14Communication hard Art.16Simplified ICT risk management framework hard

DORA Chapter III: ICT-Related Incident Management

Art.17ICT-related incident management process easy Art.18Classification of ICT-related incidents and cyber threats hard Art.19Reporting of major ICT-related incidents hard Art.23Operational or security payment-related incidents hard

DORA Chapter IV: Digital Operational Resilience Testing

Art.24General requirements for the performance of digital operational resilience testing hard Art.25Testing of ICT tools and systems hard Art.26Advanced testing of ICT tools, systems and processes based on TLPT hard Art.27Requirements for testers for the carrying out of TLPT hard

DORA Chapter V: ICT Third-Party Risk Management

Art.28ICT third-party risk: general principles hard Art.29Preliminary assessment of ICT concentration risk at entity level hard Art.30Key contractual provisions hard Art.31Designation of critical ICT third-party service providers hard

DORA Chapters VI-VII: Information Sharing, Penalties and Data Protection

Art.45Information-sharing arrangements on cyber threat information and intelligence hard Art.50Administrative penalties and remedial measures hard Art.56Data protection hard