DORA (Digital Operational Resilience Act) Audit

Audit Focus Areas

The audit assesses the principal domains defined under DORA, with a focus on governance,
resilience, control effectiveness, and the organization’s ability to maintain secure and
reliable ICT operations.

• ICT Scope, Critical Services, and Governance
  • Review of in-scope ICT systems, critical services, assets, data flows, and operational dependencies.
  • Assessment of governance structures, management oversight, and allocation of responsibilities supporting DORA requirements.
  • Verification of alignment between business operations, ICT services, and resilience objectives.
• ICT Risk Management Framework
  • Evaluation of ICT risk identification, assessment, mitigation, monitoring, and reporting practices.
  • Review of policies, procedures, and governance mechanisms supporting the ICT risk management lifecycle.
  • Assessment of whether ICT risk management is integrated into broader enterprise risk and control activities.
• ICT Incident Management and Regulatory Reporting
  • Assessment of incident detection, classification, escalation, response, and recovery processes.
  • Verification of readiness to meet DORA incident reporting expectations, timelines, and communication obligations.
  • Review of incident documentation, reporting workflows, and regulatory submission preparedness.
• Operational Resilience, Business Continuity, and Recovery
  • Evaluation of business continuity and disaster recovery capabilities supporting critical ICT services.
  • Review of controls designed to maintain service availability, integrity, and recoverability during disruption.
  • Assessment of monitoring, fallback arrangements, and restoration procedures for critical operations.
• Digital Operational Resilience Testing
  • Review of resilience testing strategies, including scenario-based testing, continuity exercises, and recovery validation.
  • Assessment of testing frequency, coverage, governance, and evidence of follow-up actions.
  • Verification of alignment with DORA expectations for resilience testing and continuous improvement.
• ICT Third-Party Risk Management
  • Evaluation of third-party risk management processes and governance over ICT suppliers and service providers.
  • Review of contracts, SLAs, control requirements, monitoring arrangements, and supplier due diligence practices.
  • Assessment of concentration risk, contingency planning, and exit strategy preparedness for critical third parties.
• Threat Intelligence and Information Sharing
  • Assessment of threat intelligence gathering, analysis, and operational use within ICT security and resilience functions.
  • Review of communication and coordination processes with internal stakeholders, authorities, and external partners during incidents.
  • Evaluation of practices supporting proactive awareness, early response, and resilience improvement.

Audit Reporting

Audit results are documented in a structured report that provides a clear and objective view of the organization’s current level of alignment with DORA requirements. The report is based on document review, stakeholder interviews, and validation of evidence across ICT governance, resilience, and operational control areas.

• Compliance Assessment: Evaluation of current practices against applicable DORA requirements and expectations.
• Gap Identification: Identification of deficiencies, control weaknesses, and areas requiring remediation.
• Maturity Evaluation: Assessment of the maturity of ICT governance, risk management, resilience, and third-party oversight.
• Strengths and Good Practices: Identification of areas where effective implementation and control design are already in place.
• Actionable Recommendations: Practical and prioritized recommendations to improve resilience, governance, and regulatory readiness.
• Executive Summary: A management-level overview of key findings, principal risks, and recommended next steps.

This output enables organizations to understand their current posture, prioritize remediation efforts, and establish a structured path toward stronger DORA compliance and improved ICT operational resilience.

Basis of Work

The audit is performed in accordance with recognized regulatory and information security frameworks, ensuring a consistent, risk-based, and defensible assessment methodology.

• Digital Operational Resilience Act (DORA): EU regulatory framework for ICT resilience in the financial sector.
• ISO/IEC 27001:2022: Information Security Management Systems — Requirements.
• ISO/IEC 27002:2022: Information security controls.
• ISO/IEC 27005:2022: Information security risk management.
• ISO/IEC 27032:2023: Cybersecurity guidelines.
• ISO/IEC 27007:2020: Guidelines for auditing information security management systems.
• Internal Policies and Procedures: Organization-specific governance, ICT control, and resilience frameworks.

This methodology helps ensure alignment between regulatory requirements and established security practices, supporting organizations in strengthening governance, improving digital resilience, and maintaining secure, reliable ICT operations.