DORA, the EU Digital Operational Resilience Act, applies from 17 January 2025. To survive an audit or supervisory review, keep a dated evidence pack across five areas: ICT risk management, incident handling, resilience testing, third party arrangements with a register, and board oversight. Evidence that shows operation over time beats any policy document.
What does DORA cover?
Regulation (EU) 2022/2554 applies to financial entities. Its recitals describe five pillars. Financial entities need comprehensive ICT risk management capabilities, and the management body keeps ultimate responsibility for ICT risk. All major ICT related incidents are reported to competent authorities. Systems and staff are tested regularly, with threat led penetration testing applying to entities mature enough to carry it out. Risks from ICT third party providers are monitored under a strategy approved by the management body. Financial entities may also exchange cyber threat information voluntarily.
The recitals also say entities must keep a register of information covering all contractual arrangements for ICT services with third parties, and supervisors can ask for the whole register or parts of it. Note that technical standards set many specifics such as incident thresholds and timelines, and we did not read those here, so take exact numbers from the current standards and your supervisor.
What evidence should you assemble?
Build the pack by pillar. For each item, keep the artefact, the date, the owner and where it lives.
Governance. The ICT risk management framework as approved by the management body, minutes showing the board reviewed ICT risk, role descriptions, and training records for the management body. Evidence of accountability is a theme in the recitals.
ICT risk management. An inventory of ICT assets and functions with their criticality, risk assessments, protection and prevention measures, detection mechanisms, response and recovery plans, and backup and restoration records. Include a recent restore test. Recital 47 notes that the risk model can vary as long as identification, protection, detection, response, recovery, learning and communication are covered, so map your model to those headings.
Incidents. A classification procedure, a log of incidents with how each was classified, templates for reports to authorities, and a record of at least one exercise of the reporting path. The log should show detection, decision, report and lessons.
Testing. A programme of tests with scope, results and remediation tracking. Include vulnerability scans, scenario tests and, where required for you, threat led testing. Auditors look for findings that were fixed, not just reports that exist.
Third parties. The register of information, due diligence performed before signing, contract terms for critical or important services, concentration risk notes, exit plans and monitoring reviews.
How do you make evidence survive scrutiny?
Dates and sampling. Reviewers pick items at random and ask to see the trail: a ticket, the change, the approval, the test. If the trail needs one person's memory to reconstruct, it will fail. Set up evidence so a sampled item can be traced in minutes.
Keep a mapping sheet from each DORA obligation to the artefact that answers it, with a named owner. Rehearse with a colleague who plays the supervisor and picks five rows at random.
What mistakes should you avoid?
- A register of information that is a spreadsheet nobody updates after contract changes.
- Incident procedures that were never exercised.
- Board minutes that record attendance but not challenge.
- Testing limited to the application while supporting providers go untested.
- Treating a provider's certificate as a substitute for your own oversight.
What to do
- Identify which DORA obligations apply to your entity type and size.
- Create the obligation to artefact mapping sheet with owners.
- Fill the register of information and agree a change process.
- Run an incident reporting exercise and save the record.
- Run a restore test and a vulnerability scan cycle, with remediation tickets.
- Do a mock review with five random samples before the real one.
Quick check
When does DORA apply?
The Regulation states that it applies from 17 January 2025.
What is the register of information?
The recitals describe it as a register of all contractual arrangements for ICT services with third party providers, which supervisors can request in full or in part.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires. For the technical rows in this pack, such as asset and dependency inventory, scan results and testing records, evidence comes from your real code and dependencies through scans, SBOMs and reachability, not screenshots, and monitoring continues between reviews. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose the categories and approval level. Supervisors and independent assessors judge your compliance. Safeguard helps you prepare and keep evidence ready.
Open the framework mapping demo
Sources
- Regulation (EU) 2022/2554 (DORA), EUR-Lex, fetched 18 October 2026
Last reviewed: 18 October 2026.
