DORA - Regulation (EU) 2022/2554

DORA Readiness Scorecard

Score your financial entity’s readiness against the ten core DORA pillars (in force since 17 January 2025).

What is DORA?

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025. It covers most EU financial entities (banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers and others) and brings their critical ICT third-party providers under EU oversight. As a regulation, it applies directly in every member state.

The five pillars

Pillar	DORA	In practice
ICT risk management	Art 5-13	A documented framework owned by the management body, covering identification, protection, detection, response, recovery and learning
Incident management and reporting	Art 17-19	Classify ICT incidents and report major ones to your authority on tight deadlines set by Delegated Regulation (EU) 2025/301
Resilience testing	Art 24-26	A testing programme, and threat-led penetration testing (TLPT) at least every three years for entities the authorities identify
ICT third-party risk	Art 28-30	A register of ICT providers, due diligence, contract terms and exit plans
Information sharing	Art 45	Voluntary sharing of cyber threat information between financial entities

If you supply ICT services to a financial entity

DORA reaches you through your customer's contracts even if you are not designated as a critical provider: expect audit rights, security requirements, incident notice obligations and exit assistance clauses. Being ready to evidence your controls makes those negotiations shorter.

The scorecard above checks ten core expectations drawn from these chapters. It is a starting gap list, not an assessment against the full regulation and its technical standards. See security testing and banks and financial services.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

Each of the ten questions is one pillar drawn from DORA’s main chapters: ICT risk management (Art 5-13), incident management and reporting (Art 17-19), resilience testing (Art 24-26), third-party risk (Art 28) and information sharing (Art 45).
Readiness = pillars answered Yes, divided by ten, rounded to a whole percentage. Every pillar carries equal weight.
Colour: below 40% is red, 40% to 74% amber, 75% or more green.
Every pillar answered No is listed as a gap.

Constants the tool uses

Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.

Weight per pillar: Equal (10 percentage points each)
Colour thresholds: Red under 40%, amber under 75%, green from 75%

Worked example

The calculator run on its default inputs:

ICT risk-management framework in place (Art. 6): No
Incident classification + major-incident reporting to the authority (Art. 17-19): No
Digital operational resilience testing programme (TLPT where designated, Art. 24-26): No
Register of ICT third-party arrangements + exit strategies (Art. 28): No
Cyber threat information-sharing arrangements (Art. 45): No
Business continuity, backup & restoration with defined RTO/RPO (Art. 11-12): No
Up-to-date inventory of ICT assets and dependencies (Art. 8): No
Patch and vulnerability management process: No
Digital operational resilience training for staff and management (Art. 13): No
Management body defines, approves and oversees the risk framework (Art. 5): No

0% DORA ready (0/10 pillars)

0%

Gap: ICT risk-management framework
Gap: Incident classification & reporting
Gap: Resilience testing / TLPT
Gap: Third-party register & exit strategies
Gap: Information-sharing arrangements
Gap: BCP, backup & RTO/RPO
Gap: ICT asset inventory
Gap: Patch & vulnerability management
Gap: Resilience training
Gap: Management-body oversight

With every answer at its default of No, the score is 0 of 10 pillars (0%) and all ten are listed as gaps. Each Yes adds 10 points; eight Yes answers (80%) are the first result that turns green.

Sources

DORA - Regulation (EU) 2022/2554 (EUR-Lex) - the pillars above, scope (Art 2), TLPT at least every 3 years (Art 26), application from 17 January 2025 (Art 64)
Commission Delegated Regulation (EU) 2025/301 (EUR-Lex) - content and time limits for major ICT-incident reports

Sources last checked September 2026.

Limitations

A yes/no answer cannot tell a documented framework from one that works, and supervisors test evidence. Proportionality (Art 4) and the simplified regime for small entities (Art 16) mean the same score can be adequate for one firm and not for another; the register of information and TLPT rules have their own technical standards not reflected here. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.