A small financial entity can run DORA on spreadsheets for a first pass: a register of information, a risk register, an incident log and a testing tracker. Automate when you have many ICT providers, the register changes monthly, or incident reporting and evidence need to be traceable under time pressure.
What does DORA need you to track?
Regulation (EU) 2022/2554, in force and applying from 17 January 2025, asks financial entities for ICT risk management, incident reporting to competent authorities, regular testing, oversight of ICT third party risk and, voluntarily, threat information sharing. Its recitals say entities must keep a register of information on all contractual arrangements for ICT services with third parties, and supervisors can request the full register or parts of it. Many details, such as incident thresholds and timelines, sit in technical standards that we did not read, so take those from current standards and your supervisor.
What should the workbook contain?
One workbook, one tab per register, with an owner and a review date on each.
- Register of information. Each ICT arrangement with provider, service, functions supported, criticality, contract dates, data location, subcontractors and exit arrangements.
- ICT asset and function inventory. Systems, owners, criticality and dependencies.
- Risk register. ICT risks with owner, treatment and review date, mapped to identification, protection, detection, response and recovery.
- Incident log. Detection time, classification, impact, report sent to the authority, root cause and lessons.
- Testing tracker. Vulnerability scans, scenario tests, restore tests, findings and remediation status.
- Third party due diligence. Pre-contract assessments, concentration risk notes and monitoring reviews.
- Governance. Management body reviews, training and approvals.
- Obligation mapping. Each obligation, the artefact that proves it and the owner.
Where do spreadsheets hold up?
For a handful of ICT providers, a stable architecture and no major incidents, a workbook is transparent and quick to set up. It teaches your team what a good register looks like and gives supervisors something concrete. It is a reasonable way to start your gap analysis.
Where do they break?
- The register. Contracts renew, services change and subcontractors appear. A register that lags contract reality is a finding. With dozens of providers, nobody can keep it right by hand.
- Incident handling. When an incident happens, you need a log with timestamps, a classification trail and report drafts, and several people editing one sheet leads to lost versions.
- Evidence lineage. Test results pasted into cells do not show which scan produced them.
- Concentration risk. Spotting several critical services on the same provider needs a query, not a glance.
- Review cadence. Dates pass with no alert.
- Several frameworks. Banks and insurers often also face ISO 27001, SOC 2 or customer audits using the same evidence.
What are the signs to automate?
Move when most of these hold: more than twenty ICT providers, monthly changes to the register, more than one team operating critical services, an incident or near miss that exposed gaps in your log, testing across many systems, or the need to reuse evidence for another framework.
What mistakes should you avoid?
- Treating a first workbook as the final system.
- Building the register from the procurement list and missing shadow IT.
- Leaving the management body out of reviews.
- Skipping an exercise of the incident reporting path.
What to do
- Build the eight tabs with owners and review dates.
- Populate the register from contracts, not the vendor list.
- Link test evidence to the originating tool output.
- Run an incident exercise with the log and report templates.
- Track upkeep hours each quarter.
- Write the triggers that will push you to automate.
Quick check
What is the main spreadsheet weakness for DORA?
The register of information, which changes with every contract and subcontractor and is hard to keep accurate by hand at scale.
When did DORA start applying?
17 January 2025, according to the Regulation text.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires. Evidence is collected from connected systems and code instead of by screenshot, and monitoring runs between reviews, which frees the team for other work. For the technical side, software dependencies and their vulnerabilities come from scans, SBOMs and reachability on your real code. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Supervisors and independent assessors judge compliance. Safeguard helps you prepare and keep evidence ready.
Open the framework mapping demo
Sources
- Regulation (EU) 2022/2554 (DORA), EUR-Lex, fetched 18 October 2026
Last reviewed: 18 October 2026.
