← All templates
DORA
EU Digital Operational Resilience Act. Covers ICT risk management, incident reporting, and third-party risk for financial entities.
20 questions·Version 2022
ICT Risk Management
- Do you have a documented ICT risk management framework?Art.6
- Is your ICT risk management framework reviewed and updated annually?Art.6
- Do you have an ICT asset inventory covering all critical systems?Art.8
- Do you classify ICT assets based on criticality and risk?Art.8
ICT Incident Management
- Do you have an ICT-related incident classification scheme?Art.17
- Can you report major ICT incidents to regulators within required timeframes?Art.19
- Do you have a process for root cause analysis of ICT incidents?Art.17
Digital Operational Resilience Testing
- Do you conduct annual ICT resilience testing?Art.24
- Do you conduct threat-led penetration testing (TLPT) where required?Art.26
- Are test results used to improve resilience measures?Art.24
ICT Third-Party Risk
- Do you maintain a register of all ICT third-party service providers?Art.28
- Do you assess concentration risk from ICT third-party providers?Art.28
- Do your ICT contracts include minimum security and resilience requirements?Art.30
- Do you have exit strategies for critical ICT third-party providers?Art.28
- Do you monitor the operational resilience of critical ICT providers?Art.28
Business Continuity
- Do you have ICT business continuity policies and plans?Art.11
- Are recovery time and recovery point objectives defined for critical systems?Art.11
- Do you conduct annual business continuity testing including ICT scenarios?Art.11
Governance
- Has the management body approved the ICT risk management framework?Art.5
- Does management receive regular reports on ICT risk exposure?Art.5
Send this questionnaire to your vendors
VendorAuditly automatically scores responses, maps answers to framework controls, and tracks coverage over time. Free to start.