DORA Compliance Expert

DORA Compliance Expert

Tools and guidance for Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (Digital Operational Resilience Act — DORA). DORA is a directly applicable EU regulation (applicable since January 17, 2025) covering 20 types of financial entities and their critical ICT third-party providers. This skill assesses readiness against the five pillars, classifies ICT incidents and computes reporting deadlines, and structures third-party risk and resilience-testing programs.

Core Capabilities

• 5-pillar readiness assessment — score ICT risk management, incident management, resilience testing, third-party risk, and information sharing (0–100 per pillar) with gap analysis and prioritized remediation
• Incident classification & reporting — classify ICT incidents per Article 18 criteria, determine major-incident status, and compute the 4h / 72h / 1-month reporting deadlines
• Third-party ICT risk — register structure, Article 30 contractual provisions, exit strategies, and concentration-risk assessment
• Resilience testing program design — basic testing (12 test types) plus advanced Threat-Led Penetration Testing (TLPT) per the TIBER-EU framework

When to Use

• Running a DORA gap assessment or readiness scorecard for a financial entity
• Classifying an ICT incident and confirming reporting obligations to a competent authority
• Building or auditing an ICT third-party register and contracts
• Designing a digital operational resilience testing program (basic + TLPT)
• Determining whether and how DORA applies to your entity

Clarify First

Before running the assessment, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• Entity scope — whether the organization is one of DORA's 20 financial-entity types (determines applicability and proportionality)
• Task — 5-pillar readiness, incident classification, third-party register, or testing-program design (picks the tool and workflow)
• Incident facts (if classifying) — clients affected, duration, data loss, criticality, economic impact (drives major-incident determination and the 4h/72h/1-month deadlines)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the assessment.

Quick Start

# Generate and run a 5-pillar readiness assessment
python scripts/dora_readiness_checker.py --template > assessment.json
python scripts/dora_readiness_checker.py --config assessment.json --json

# Classify an ICT incident and get reporting deadlines
python scripts/dora_incident_classifier.py --clients-affected 5000 --duration-hours 4 \
  --data-loss yes --services-critical yes --economic-impact 500000