™
DORA, without an enterprise budget.
ICT risk management, incident reporting, third-party oversight and resilience testing — 260 controls, included.
Operational resilience, now supervised
The Digital Operational Resilience Act applies across the EU financial sector and it is broad by design: ICT risk management, incident classification and reporting, resilience testing, and oversight of third-party ICT providers — with a register of information you are expected to maintain and submit.
Most DORA tooling is priced for tier-one banks. If you are a payment institution, an insurance intermediary, a crypto-asset provider or a smaller investment firm, you carry a comparable obligation on a fraction of the budget.
OpenGRC includes DORA and the regulatory technical standards bundles — ICT risk management, incident reporting, ICT services supporting critical functions, threat-led penetration testing — on every plan.
The four pillars, operationalised.
Third-party ICT register
DORA expects a maintained register of ICT third-party arrangements. Vendor management holds the inventory, contract and document tracking with expiry, risk scoring and questionnaires — and the application registry records what each one supports.
Incident classification and reporting
Incidents follow a six-phase process with playbooks, tasks and a full timeline, and notification deadline tracking runs the clock from the moment an incident is opened.
Resilience testing evidence
Testing programmes, including threat-led penetration testing, produce findings that flow into remediation projects with owners and milestones rather than sitting in a PDF.
DORA and its technical standards
| Bundle | Controls |
|---|---|
| DORA — the Regulation itself | 260 |
| RTS on ICT risk management framework and simplified framework | 554 |
| RTS on threat-led penetration testing | 295 |
| RTS on ICT services supporting critical or important functions | 94 |
| RTS on classification of ICT-related incidents | 81 |
| RTS on incident reporting | 59 |
| RTS on harmonisation of oversight conduct conditions | 78 |
| RTS on joint examination teams | 47 |
| TIBER-EU framework | 36 |
| NOREA DORA in Control Framework v3.0 | 95 |
| CROE — cyber resilience oversight expectations for FMIs | 331 |
That is 1,930 controls across the DORA family, all included on every plan. Import the Regulation alone, or add the technical standards that apply to your entity type and testing obligations. Control coverage aggregates across all of them, so overlapping requirements are evidenced once.
DORA questions
Does DORA apply to us?
It applies broadly across EU financial entities — banks, insurers and intermediaries, investment firms, payment and e-money institutions, crypto-asset service providers and more — and to critical ICT third-party providers serving them. Scope is a legal question, not a software one, so take advice if you are unsure.