DORA Compliance Pack

Description

DORA documentation for small and mid-sized financial entities, built from the official texts. 42 editable files take you from applicability through incident reporting, resilience testing and the register of information — with 1,173 requirements of DORA and its RTS and ITS mapped to a document, and the 16 places where the law is open flagged instead of guessed.

DORA is live. Its detail sits in nine legal acts.

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025. The Regulation sets the obligations; eight technical standards fill in the detail. The classification thresholds for a major incident are in one delegated regulation, the reporting time limits in another, the report forms in an implementing regulation, the register-of-information templates in a fourth, and the simplified framework for smaller entities in a fifth.

Documentation built from summaries of those texts leaves you checking every line yourself. This pack does the opposite: each document tells you which provision a statement rests on, quotes the legal text where the wording matters, and says plainly where the text gives no answer.

Built from the official texts — and honest where they are open

Every article, paragraph, point, threshold, time limit and template field cited in the pack comes from the published text of these nine acts:

The documents keep law and advice apart, and label the difference. Words in quotation marks are copied exactly from the legal text. A pack choice is a frequency, deadline or threshold the pack proposes so the document works in practice — the law does not set it, and you may change it. A pack reading marks a provision that can reasonably be read more than one way.

16 interpretation points, out in the open. DORA and its standards leave some questions unanswered. The Welcome guide lists all 16 in one table — the question, the pack’s default, and the document where it applies — so your management body decides them knowingly instead of discovering them in a supervisory review. Two examples:

• Does the resilience testing of Article 24 apply to Article 16(1) entities, when Article 16(1) disapplies only Articles 5 to 15? The pack applies it, sets out both readings and leaves the decision to the management body.
• Under RTS (EU) 2024/1772, does the “two or more Member States” threshold for geographical spread count your home Member State? The text does not say. The classification tool computes the result under each reading and shows DEPENDS ON INTERPRETATION when they differ.

Where a pack default is the more demanding reading, it was chosen so that a later view from your competent authority does not leave you with a gap.

What’s inside — 36 templates + 6 guides (42 files)

See all 42 files

Doc	Title	Format	Main legal basis
G1	Welcome and How to Use This Pack	Word	Pack overview
G2	DORA Implementation Guide	Word	Three routes, phased
G3	DORA Requirements Master Map	Excel	All nine acts
G4	Applicability and Proportionality Assessment	Word	Arts 2, 3(60), 4, 16
G5	DORA Role Matrix	Word	Arts 5, 6(4)
G6	Readiness Checklist and 90-Day Plan	Word	Chapters II–V
D01	Management Body ICT Responsibilities and Approval Record	Word	Art. 5
D02	ICT Risk Management Framework	Word	Art. 6; RTS 2024/1774 Arts 1–3
D03	Digital Operational Resilience Strategy	Word	Art. 6(8)
D04	ICT Risk Assessment Methodology	Word	Arts 6, 8; RTS 2024/1774 Art. 3
D04R	ICT Risk Register	Excel	Arts 6(8)(b), 8
D05	Information Security Policy	Word	Art. 9(4)(a); RTS 2024/1774 Arts 2, 29
D06	ICT Asset Management Policy and Procedure	Word	Art. 8; RTS 2024/1774 Arts 4–5
D06R	ICT Asset Register	Excel	Art. 8
D07	Encryption and Cryptographic Key Management Policy	Word	RTS 2024/1774 Arts 6–7
D08	ICT Operations, Capacity and Performance Policy	Word	Art. 7; RTS 2024/1774 Arts 8–9
D09	Vulnerability and Patch Management Procedure	Word	RTS 2024/1774 Art. 10
D10	Data, System and Network Security Policy	Word	Art. 9; RTS 2024/1774 Arts 11, 13, 14
D11	Logging and Anomalous Activity Detection Procedure	Word	Art. 10; RTS 2024/1774 Arts 12, 23
D12	ICT Project, Acquisition, Development and Change Management	Word	RTS 2024/1774 Arts 15–17
D13	Physical and Environmental Security Policy	Word	RTS 2024/1774 Art. 18
D14	Human Resources, Identity Management and Access Control Policy	Word	RTS 2024/1774 Arts 19–21
D15	ICT Business Continuity Policy and Response and Recovery Plans	Word	Art. 11; RTS 2024/1774 Arts 24–26
D16	Backup, Restoration and Recovery Procedure	Word	Art. 12
D17	Learning and Evolving: Post-Incident Review and Training Record	Word	Art. 13
D18	Crisis Communication Plan	Word	Art. 14
D19	Report on the Review of the ICT Risk Management Framework	Word	Art. 6(5); RTS 2024/1774 Art. 27
D20	Simplified ICT Risk Management Framework	Word	Art. 16; RTS 2024/1774 Arts 28–41
D21	ICT-Related Incident Management Policy and Process	Word	Art. 17
D22	Incident Classification Tool	Excel	Art. 18; RTS 2024/1772
D23	Major ICT-Related Incident Reporting Procedure	Word	Art. 19; RTS 2025/301
D24	Incident Report Drafting Workbook	Excel	Arts 19–20; ITS 2025/302
D25	Incident and Cyber Threat Log	Excel	Arts 17–19
D26	Digital Operational Resilience Testing Programme	Word	Arts 24–25
D27	Test Plan, Test Report and Findings Register	Word	Arts 24–25
D28	TLPT Readiness Guide	Word	Arts 26–27; RTS 2025/1190
D29	Policy on ICT Services Supporting Critical or Important Functions	Word	Art. 28(2); RTS 2024/1773
D30	Pre-Contract Risk Assessment and Due Diligence Checklist	Word	Art. 28(4)
D31	Register of Information Workbook	Excel	Art. 28(3); ITS 2024/2956
D32	Key Contractual Provisions Checklist and Clause Bank	Word	Art. 30
D33	Subcontracting Assessment Checklist	Word	RTS 2025/532
D34	Exit Strategy and Exit Plan	Word	Art. 28(8)

Seven working spreadsheets, not tables pasted into Word

• Incident Classification Tool (D22). One sheet per criterion of RTS (EU) 2024/1772 — clients and transactions, reputational impact, duration and downtime, geographical spread, data losses, critical services, economic impact — leading to a major / not major determination, plus recurring incidents and significant cyber threats. Seven interpretation settings are approved once; the alternative readings are always computed and shown.
• Incident Report Drafting Workbook (D24). Every field of the ITS (EU) 2025/302 annexes: 76 fields of the major-incident template (initial, intermediate and final report) and 20 fields of the cyber-threat notification, with a submission check before anything is sent.
• Incident and Cyber Threat Log (D25). One register for every ICT-related incident and cyber threat, with timeline, submissions and reporting clock, impact costs and losses, and a dashboard of checks.
• Register of Information Workbook (D31). All 15 templates of ITS (EU) 2024/2956, B_01.01 to B_99.01, with the ITS column codes and names, a field dictionary and a completeness check that flags missing mandatory fields.
• Requirements Master Map (G3). 1,173 requirements from the nine acts, each with a verbatim excerpt, whether it applies to a full-framework entity, a microenterprise or an Article 16(1) entity, and the pack document and section that addresses it. Set your profile and TLPT status, and every row is marked as applying to you or not, with a coverage dashboard on top.
• ICT Risk Register (D04R) and ICT Asset Register (D06R). Functions, assets, information assets, dependencies and third parties in one place, with risk treatment, accepted risks and dashboards.

Dropdown lists guide the inputs in all seven workbooks; formula cells are shaded grey and the sheets are not protected, so you can add columns and adapt formulas freely. No macros.

One pack, three routes — decided before you write a word

DORA is not one-size-fits-all, and the pack does not pretend it is. The Applicability and Proportionality Assessment (G4) records your Article 2(1) category, any exclusion, microenterprise status (Art. 3(60)), Article 16(1) status and TLPT identification. The answer sets your route:

Almost every template has a proportionate-application section, so a payment institution, an e-money institution, an investment firm, a crypto-asset service provider or an insurance intermediary adapts one set of documents instead of hunting for the parts that apply. A small entity does not need 42 separately approved documents: the framework document explains how to merge components, as long as each still has exactly one home.

ICT providers answering client DORA demands. The pack is written from the financial entity’s side, and that is what a provider needs to see. G4 has an ICT third-party service provider path, and the clause bank (D32) has a section on using it as a provider: map your standard terms against every Article 30 element, prepare a DORA addendum, and get ready the subcontracting information your customers must record in their register (D31, template B_05.02).

Start where the deadlines are

Incident reporting has external time limits, and RTS (EU) 2025/301 sets them: the initial notification within four hours of classifying an incident as major and no later than 24 hours after becoming aware of it, the intermediate report within 72 hours of the initial notification, the final report one month after the latest intermediate report. The readiness checklist (G6) opens with a Week-1 minimum — be able to classify an incident and, if it is major, notify on time — then a 90-day plan. The implementation guide (G2) sets the order and the dependencies between documents for each route, so you approve the applicability assessment first and adapt each template once.

What the pack does not do

• It is not legal advice and does not guarantee compliance. You adapt every document to your authorisation, systems and providers, decide the interpretation points, and your management body approves the result.
• It states no penalty amounts. DORA leaves penalties to the Member States (Art. 50(3)).
• It does not quote ESA joint guidelines, Q&As or national supervisory guidance. Each document has a place to record the guidance your competent authority expects you to follow.
• The workbooks are where you prepare the register and the reports. Submit them in the format and through the channel your competent authority specifies.
• The model contract clauses are drafting, not law: have them reviewed against the law governing each contract before use.

The pack vs. the alternatives

Honest note: a template pack replaces the drafting, not the implementing. You still run the controls, keep the records and make the decisions. The pack is built so that those records have a defined home and every document points to the provision behind it.

Software

Documents are Word files (.docx) for Microsoft Word or LibreOffice Writer. The spreadsheets need Microsoft Excel 2019 / Microsoft 365 or LibreOffice Calc. Excel 2016 and older lack the MINIFS/MAXIFS functions some dashboard cells use and show #NAME? there.

See the quality before you buy

Three free sample PDFs from the pack:

• G1 Welcome and How to Use This Pack — the complete guide, including the full file list and all 16 interpretation points
• D22 Incident Classification Tool — instructions, major-incident determination and result sheets
• D29 Policy on ICT Services Supporting Critical or Important Functions — cover, full table of contents and the first pages

Frequently asked questions

Does this pack make us DORA compliant?

No template can, and be wary of any that claims to. Compliance depends on what your entity actually does. The pack gives you the documents DORA and its technical standards call for, each tied to the provisions behind it; you adapt them to your authorisation, systems and providers, decide the open interpretation points, and your management body approves the result.

Which legal texts does it follow?

Regulation (EU) 2022/2554 (DORA) and eight technical standards: Delegated Regulations (EU) 2024/1774, 2024/1772, 2025/301, 2024/1773, 2025/532 and 2025/1190, and Implementing Regulations (EU) 2025/302 and 2024/2956. Citations go to article, paragraph or point level, and text in quotation marks is copied exactly. ESA guidelines, Q&As and national guidance are not quoted. Before relying on a provision, check EUR-Lex for amendments made after the date of your pack version.

What are the 16 interpretation points?

Questions the legal texts leave open — for example whether Article 24 testing applies to Article 16(1) entities, how the geographical-spread threshold counts Member States, or whether a separate cloud tenancy counts as physically segregated for restoration under Article 12(3). The Welcome guide lists all 16 with the pack’s default and the document concerned. Your management body decides them, on legal advice where needed, and records the decision.

We are a microenterprise or an Article 16(1) entity. Is this for us?

Yes. The applicability assessment (G4) establishes your status, and the implementation guide (G2) has a separate route for each case. Article 16(1) entities use the simplified framework (D20) under RTS (EU) 2024/1774 Title III in place of most Chapter II documents. Microenterprises keep most documents with the relief the law grants, and do not need the TLPT readiness guide.

We are an ICT provider, not a financial entity. Is it useful?

If your customers are financial entities, they must put the DORA Article 30 contract elements into their contracts with you and record your services in their register of information. The pack shows you exactly what they will ask for: G4 has an ICT provider path, and the clause bank (D32) has a section on using it as a provider to map your terms and prepare a DORA addendum. The rest of the pack is written for the financial entity itself.

What software do I need?

Microsoft Word or LibreOffice Writer for the 35 documents. For the 7 spreadsheets, Microsoft Excel 2019 / Microsoft 365 or LibreOffice Calc; Excel 2016 and older show #NAME? in some dashboard cells. No macros.

Does it cover NIS2 or national rules?

The pack implements DORA. The applicability assessment records whether you have also been identified under national NIS2 rules, because DORA Article 1(2) treats DORA as the sector-specific act for those entities; national law and penalties are outside its scope (DORA leaves penalties to the Member States, Art. 50(3)). For NIS2 itself, see our NIS2 Complete Toolkit.

Can we submit the register or incident reports straight from the workbooks?

The workbooks follow the ITS templates and forms field by field and check completeness, but they are where you prepare the content. The ITS do not set a file format for the register; submit in the format and through the channel your competent authority specifies.

Templates are general working documents, not legal or professional advice, and do not guarantee compliance with Regulation (EU) 2022/2554, its technical standards or any national law. Adapt them to your organisation and confirm uncertain points with qualified legal counsel or your competent authority. References to EU legal acts are to the texts published on EUR-Lex; this product is independent and is not affiliated with or endorsed by any EU institution or supervisory authority.