Under DORA, auditors and supervisors will expect evidence for five areas: your ICT risk management framework, the register of ICT third party contracts, incident records and reports, resilience testing results, and the contract terms you hold with ICT providers. The regulation has applied since 17 January 2025.
What is DORA?
DORA is Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. Article 64 states that it applies from 17 January 2025. The text of the regulation is on EUR-Lex, and the recitals explain the intent behind each requirement, which helps when you decide what proof is reasonable. Whether you are in scope, and whether a simplified framework applies to you, is set out in the regulation. Confirm that with your compliance team.
Evidence for the ICT risk management framework
The recitals say management bodies should keep an active role in steering the framework and bear ultimate responsibility for ICT risk. So the first thing to produce is proof of that: board or management minutes that show ICT risk was discussed, approved and followed up. The framework itself needs to cover the core functions the regulation lists, and the recitals mention keeping systems updated, continuity and recovery plans, and recovery objectives. Bring the plan, the last test of it and what changed afterwards.
Evidence for the register of information
Article 28(3) requires financial entities to keep a register of information about all contractual arrangements for ICT services from third party providers, and supervisors can ask for the whole register or sections of it. Expect questions about completeness. A practical check is to reconcile the register against accounts payable and against cloud and software accounts, so a provider paid for but missing from the register shows up before an auditor finds it.
Software suppliers belong in this picture. For each provider, you should be able to show what service they supply, which function it supports, and how you would exit.
Evidence for incident handling
The recitals call for a single, streamlined reporting framework and say major incidents are reported to the competent authority, with materiality thresholds and timelines set in delegated acts. Do not memorize numbers from a blog. Read the current delegated acts and build your timeline from them. Auditors will want the classification method, a sample of past incidents with how each was classified, and proof that your reporting contacts and templates work.
Evidence for resilience testing
The regulation expects regular testing of ICT systems and staff using a range of tools, and the recitals say advanced threat-led penetration testing applies to entities mature enough to carry it out. Keep test plans, results, the list of findings and, most important, the remediation records. A finding without a closed ticket is a finding an auditor will ask about twice.
Vulnerability work counts here. Records of what was found in your software, which flaws were reachable, and when they were fixed show testing turning into action.
Evidence for contract terms
The recitals list core contract elements: full service descriptions, data locations, data access and return on insolvency or discontinuation, cooperation with authorities, and termination rights with minimum notice. For critical or important functions they add service level targets, reporting obligations and participation in testing, plus access, inspection and audit rights. Build a simple matrix: provider on one axis, clause on the other, and a date you last checked.
What to do
- Confirm your scope and any simplified framework treatment with your compliance team.
- Collect management minutes showing active oversight of ICT risk.
- Reconcile the register of information against payments and cloud accounts.
- Build a provider by clause matrix for contract terms.
- Write your incident classification and reporting steps from the current delegated acts.
- Keep test plans, findings and closed remediation tickets together.
- Dry run: pick one provider and one incident, and time how long it takes to produce the full evidence set.
Quick check
When did DORA start to apply?
17 January 2025, according to Article 64 of Regulation (EU) 2022/2554.
Does Safeguard make a firm DORA compliant?
No. Safeguard can help with software inventory, vulnerability evidence and compliance automation, but compliance is determined by your firm's controls and its supervisor.
Sources
Last reviewed: 18 October 2026.
