EU DORA checker: in scope?, what is missing, when is the incident report due. Free, private

Who you are

What kind of organisation are you?

Size

Do you rely on a listed exemption (small fund manager, small insurer, small pension fund, MiFID-exempt firm)?

Small, non-interconnected firm eligible for the simplified framework (Art 16)?

Has your authority identified you for threat-led penetration testing?

Do any services support a critical or important function?

Financial entity: what you have in place

The management body defines, approves and oversees the ICT risk framework, is trained, and owns the risk

A documented ICT risk-management framework: asset inventory, protection and prevention, detection, response and recovery, backup, learning, communication

An ICT incident process that logs, classifies (by clients affected, duration, spread, data loss, criticality, economic impact) and escalates incidents

Procedures and contacts to file major-incident initial, intermediate and final reports, and to notify clients where their interests are hit

A digital operational resilience testing programme, with tests of ICT tools and systems at least yearly

A register of information on every contract with an ICT third-party provider, kept up to date and ready to give the supervisor

Due diligence and a concentration-risk check before contracting an ICT provider, and a documented third-party risk strategy

Contracts with ICT providers carry the mandatory provisions (see the provider list below)

Exit strategies and tested transition plans for ICT services that support critical or important functions

Threat-led penetration testing (TLPT) on live production systems at least every three years, when your authority identifies you

Contracts with ICT providers (or, if you are the provider, your standard contract)

A clear description of all functions and services, and whether and on what conditions subcontracting is allowed

The countries and regions where the service is provided and data is processed and stored, with notice of any change

Provisions on availability, authenticity, integrity and confidentiality of data, including personal data

Access to, recovery and return of data in an easily accessible format if the provider is insolvent, resolved or the contract ends

Service-level descriptions, with precise quantitative and qualitative performance targets

The provider helps with ICT incidents, at no extra cost or at a cost fixed in advance

The provider cooperates with the competent and resolution authorities

Termination rights and minimum notice periods that match what authorities expect

The provider takes part in the entity's ICT security awareness and resilience training

Notice periods and reporting duties for developments that could materially affect the service

The provider implements and tests business-contingency and security plans

The provider takes part in and fully cooperates in the entity's TLPT

Unrestricted rights of access, inspection and audit for the entity, its auditors and authorities

Exit strategies, including a mandatory adequate transition period in which the provider keeps serving

A live major ICT incident (optional)

Enter times in one time zone, as YYYY-MM-DDTHH:MM. Never type incident details.

You became aware at

Classified as major at

Initial notification sent at

Intermediate report sent at

Now (leave empty for the current time)

Choose what kind of organisation you are, then click Check my readiness.

Result

What it does, and what it leaves to you

Scope: DORA lists the financial entities it covers (Article 2). It has applied since 17 January 2025.
Duty areas: ICT risk management (Arts 5 to 16), incident handling and reporting (Arts 17 to 23), resilience testing (Arts 24 to 27) and third-party risk (Arts 28 to 44).
Contracts: the Article 30 terms every ICT contract must carry, with extra terms for critical or important functions.
Incident clocks: initial notification within 4 hours of classification and at most 24 hours from awareness, intermediate within 72 hours, final within one month, as set by the incident-reporting technical standards.
Not decided: whether an incident is major under the classification thresholds, your supervisor's reporting channel and weekend rules, national add-ons, whether you are designated critical, and whether your controls are good enough, only whether they exist.

Common questions

Does DORA apply to my company?

DORA (Regulation (EU) 2022/2554) applies since 17 January 2025 to banks, payment and e-money institutions, investment firms, insurers, crypto-asset service providers, fund managers, trading venues and a list of other financial entities. It does not apply directly to small insurance intermediaries. Software and cloud vendors are not regulated directly unless designated critical, but their financial-sector customers must put DORA terms in the contract.

How fast must a major ICT incident be reported?

The initial notification is due within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it. The intermediate report follows within 72 hours of the initial one, and the final report, with root cause, within one month of the last intermediate report.

What must a contract with an ICT provider contain?

Article 30 lists the terms: service and subcontracting description, data locations, data protection, data return on insolvency or exit, service levels, incident assistance, cooperation with authorities, termination rights and training. For critical or important functions it adds full SLAs, contingency testing, TLPT cooperation, unrestricted audit and access rights and an exit plan with a transition period.

I sell software to banks. What do I need to do?

Expect your customers to send DORA addenda. Use the provider mode here to see which Article 30 terms your contracts still lack, so you can answer a security questionnaire from your own list instead of from a stranger's.

Is my data uploaded anywhere?

No. Everything is calculated in your browser and nothing is sent; a test in the code asserts there are no network calls. Do not type real incident details; the clocks only need times.