EU DORA

Digital Operational Resilience Act: ICT third-party risk, supply chain resilience, operational continuity.


Short name	DORA
Region	Europe
Country or scope	European Union
Sector	Finance
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers DORA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 13 controls from Safeguard's control catalog for DORA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 26: 4 written for DORA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`EU-DORA-8` ICT Asset Identification	Financial entities must identify, classify and document all ICT-supported business functions and the ICT assets underpinning them, which includes the software components of critical systems (DORA Art. 8)	Scan
`EU-DORA-8V` Asset Records with Versions	Identification of ICT assets must be kept up to date and support risk assessment, requiring recorded versions for the software components in scope (DORA Art. 8(1),(4))	Scan
`EU-DORA-9` Protection and Integrity of ICT Systems	Entities must protect the integrity and security of ICT systems with sound policies and tools, including means to verify that deployed software components are authentic and unmodified (DORA Art. 9)	Scan
`EU-DORA-28` Third-Party Provider Register	Entities must manage ICT third-party risk and maintain a register of information on all contractual arrangements with ICT providers, requiring supplier attribution for the software they depend on (DORA Art. 28)	Scan
`EU-DORA-17` Incident Classification Readiness	ICT-related incidents must be detected, managed and classified for reporting, which requires the ability to pinpoint affected software components against advisories (DORA Arts. 17-19)	Scan
`EU-DORA-DOC` Auditable Resilience Documentation	The ICT risk management framework must be documented and reviewed, with evidence artefacts that are identifiable and dated (DORA Art. 6, documentation and review of the framework)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`DORA-ART5`	Establish ICT Risk Management Framework
`DORA-ART6`	Maintain ICT Asset Register
`DORA-ART8`	Implement ICT Security Policies and Procedures
`DORA-ART9`	Implement ICT Business Continuity Management
`DORA-ART10`	Conduct ICT Testing and Vulnerability Assessments
`DORA-ART11`	Implement ICT-Related Incident Management Process
`DORA-ART12`	Classify and Report Major ICT-Related Incidents
`DORA-ART17`	Establish Major Incident Notification Procedure
`DORA-ART28`	Implement ICT Third-Party Risk Management Policy
`DORA-ART29`	Conduct Pre-Contractual Due Diligence on ICT Providers
`DORA-ART30`	Include Mandatory Provisions in ICT Provider Contracts
`DORA-ART18`	Perform Threat-Led Penetration Testing (TLPT)
`DORA-REGISTER`	Maintain Register of ICT Third-Party Service Providers

Policy templates

Written for DORA:

DORA ICT Risk Management Policy
DORA ICT Third-Party Risk Management Policy
DORA ICT Incident Management and Reporting Policy
DORA Digital Operational Resilience Testing Policy

And 22 from the standard set, adapted to DORA.