DORA Compliance Assessment

Find out if the Digital Operational Resilience Act applies to your organisation, where you stand, and what to do next.

7 questions

90s to complete

0 registration needed

What you will get

Whether DORA applies to your organisation and under which regime
Your readiness score across all five DORA compliance pillars
Penalty exposure based on your jurisdiction
Prioritised action steps with Article references

Step 1

What type of financial entity is your organisation?

Select the category that best describes your organisation's regulated activity. If you provide ICT services to financial entities but are not one yourself, select "ICT third-party service provider" at the bottom.

Step 2

Checking if an exemption applies

Step 2

Has your organisation been designated as a Critical ICT Third-Party Provider?

The European Supervisory Authorities designated the first 19 Critical ICT Third-Party Providers (CTPPs) in November 2025. CTPPs are subject to direct oversight and EU-harmonised penalty payments. If you haven't been formally notified of designation, you are not a CTPP.

Yes, we are a designated CTPP

No

Not sure If you have not received a formal designation notice from EBA, ESMA, or EIOPA, you are almost certainly not a CTPP.

Step 3

How large is your organisation?

Your size category determines whether you qualify for lighter requirements. Thresholds are based on headcount, annual turnover, and total balance sheet.

Micro Fewer than 10 employees AND turnover or balance sheet up to €2 million

Small 10 to 49 employees AND turnover or balance sheet above €2M but not above €10M

Medium 50 to 249 employees AND turnover up to €50M or balance sheet up to €43M

Large 250 or more employees, or exceeding medium-size thresholds

Step 4

Does your organisation fall into one of these specific categories?

Certain smaller financial entities qualify for a simplified ICT risk management framework with lighter requirements. This does not exempt you from DORA, but reduces the scope of your obligations under Articles 5 to 15.

Small, non-interconnected investment firm You meet the conditions under Article 12(1) of Regulation (EU) 2019/2033 (the Investment Firms Regulation).

Payment institution operating under a PSD2 exemption Your national regulator granted you a limited authorisation exemption under the Payment Services Directive.

Institution exempt under the Capital Requirements Directive You fall under one of the exemptions in Directive 2013/36/EU and your member state has not opted you back in under DORA Article 2(4).

Electronic money institution operating under an E-Money Directive exemption You benefit from a limited authorisation exemption under Directive 2009/110/EC.

Small pension provider You manage pension schemes with fewer than 100 members in total.

None of the above, or not sure You will be assessed under the full DORA framework.

Step 5

How far along are you in these areas?

Rate your organisation's current status in each of DORA's five compliance pillars. Be honest. A realistic baseline is more useful than an optimistic one.

ICT risk management

Documented policies, risk assessments, asset inventory, business continuity plans

ICT incident reporting

Classification process, reporting to your national regulator within required timelines

Operational resilience testing

Vulnerability scans, scenario-based testing, penetration tests

ICT third-party risk management

Register of all ICT providers, contract reviews, exit strategies, concentration risk

Cyber threat information sharing

Arrangements with other financial entities or sector groups for exchanging threat intelligence

Step 6

Do you have a documented process for classifying major ICT incidents?

DORA requires financial entities to classify ICT incidents using specific quantitative thresholds set out in a Delegated Regulation. A major incident must be reported to your regulator within strict timelines. This question checks whether you have the classification step in place.

Yes, we use documented quantitative thresholds

We have a general incident process, but no DORA-specific thresholds yet

No documented classification process

Step 7

Where is your organisation authorised or established?

DORA leaves penalty amounts to national law. Your country of authorisation determines the specific fines that could apply to your organisation.