DORA

The map

Five minutes, once. Rate each pillar before you start and the cards you are shakiest on come first. Skipping it costs you nothing but the ordering.

1. Scope — finance, and the suppliers behind it

   Twenty-odd categories of financial entity, plus the ICT providers they depend on.

   • Twenty categories, and the providers behind them
   • DORA beats NIS2 where both apply
   • Proportionate, not optional

2. Governance — the management body owns it

   Final responsibility is named, and it is not the CISO's.

   • Ultimate responsibility has a name
   • A framework, reviewed on two triggers
   • The board has to keep up

3. Incidents — classify, then report three times

   Only major incidents are reportable, and the deadlines are not in the Regulation.

   • Only major incidents are reportable
   • The clocks are not in the Regulation
   • Clients, and threats you were not asked about

4. Testing — and then the hard kind

   An annual programme for everyone; threat-led penetration testing for some.

   • A programme, not an annual pentest
   • Threat-led penetration testing, on production

5. Third-party risk — the register and the overseer

   Every ICT contract in one register, mandatory clauses, and direct EU oversight of the biggest providers.

   • The register of information
   • Clauses the contract has to contain
   • You have to be able to leave
   • The EU supervises your cloud provider directly