| Encryption | Art. 21(2)(h)Are policies and procedures in place governing the use of cryptography, including encryption standards for data at rest and in transit? | Art. 9(4)(d)Is data encrypted at rest and in transit using industry-standard cryptographic techniques, with documented key management procedures? |
| Access Control | Art. 21(2)(i)Is there a formal access control policy enforcing least privilege principle, with documented procedures for access provisioning and de-provisioning? | Art. 9(4)(c)Is there a formal identity and access management policy enforcing least privilege, multi-factor authentication for critical systems, and regular access recertification? |
| Identity Management | Art. 21(2)(i)Is there a formal access control policy enforcing least privilege principle, with documented procedures for access provisioning and de-provisioning? | Art. 9(4)(c)Is there a formal identity and access management policy enforcing least privilege, multi-factor authentication for critical systems, and regular access recertification? |
| Authentication & MFA | Art. 21(2)(j)Is multi-factor authentication or continuous authentication deployed for access to critical systems, remote access, and privileged accounts? | Art. 9(4)(c)Is there a formal identity and access management policy enforcing least privilege, multi-factor authentication for critical systems, and regular access recertification? |
| Network Security | Art. 21(2)(g)Are basic cyber hygiene practices established and enforced, including patching, password policies, device management, and network segmentation? | Art. 9(4)(b)Are network security controls (segmentation, firewalls, intrusion prevention) implemented to protect ICT systems, with regular review and hardening? |
| Vulnerability Management | Art. 21(2)(e)Is there a vulnerability handling and disclosure process that ensures timely identification, assessment, and remediation of vulnerabilities? | Art. 9(4)(a)Is there a formal patch and vulnerability management process that ensures timely remediation of identified vulnerabilities in all ICT systems? |
| Logging & Monitoring | Art. 21(2)(f)Are security metrics and KPIs defined, tracked, and reported to management to measure the effectiveness of cybersecurity controls? | Art. 10(1)–(4)Do you operate continuous monitoring and detection capabilities (SIEM, IDS/IPS, anomaly detection) to promptly identify ICT-related incidents and anomalous activities? |
| Incident Management | Art. 21(2)(b)Is there a documented incident handling procedure covering detection, analysis, containment, eradication, and recovery phases? | Art. 17(1)–(2)Do you have a documented ICT incident management process covering detection, recording, classification, escalation, response, and closure? |
| Incident Classification | Art. 23(3)Are incident classification criteria documented, distinguishing significant incidents based on impact on service provision, affected users, duration, and geographic scope? | Art. 18(1)Are incidents classified as major or non-major using documented criteria aligned with DORA thresholds? Art. 18(1)(a)–(g)Does classification consider all DORA quantitative criteria: number of clients affected, transaction value, duration, geographic spread, data losses, criticality of affected services, and economic impact? |
| Incident Reporting | Art. 23(4)(a)–(b)Can your organisation submit an early warning to the CSIRT within 24 hours and an incident notification within 72 hours of becoming aware of a significant incident? | Art. 19(4)(a)Can your organisation submit initial incident notifications to the competent authority within 4 hours of classifying an ICT incident as major? Art. 19(4)(b)–(c)Do you have processes and templates to submit the intermediate report (within 72 hours) and final report (within 1 month) for major ICT incidents? |
| Incident Response Team | Art. 21(2)(b)Is there a documented incident handling procedure covering detection, analysis, containment, eradication, and recovery phases? | Art. 17(2)Is a dedicated incident response team established with defined roles, escalation paths, on-call procedures, and authority to act during ICT incidents? |
| Post-Incident Review | Art. 21(2)(b)Do you perform post-incident reviews for significant incidents, with root cause analysis and lessons learned fed into risk management improvements? | Art. 17(3)Do you perform formal post-incident reviews with root cause analysis for all major ICT incidents, with findings fed back into the risk management framework? |
| Business Continuity | Art. 21(2)(c)Are business continuity and disaster recovery plans documented, covering all critical services, with defined RTO/RPO targets and tested at least annually? | Art. 11(1)–(11)Are ICT business continuity and disaster recovery plans documented, tested at least annually, approved by management, and covering all critical business functions? |
| Backup & Restoration | Art. 21(2)(c)Are backup procedures implemented with defined scope, frequency, and secure off-site storage, with regular restoration testing? | Art. 12(1)–(7)Do you maintain backup and restoration policies specifying scope, frequency, and secure storage locations, with regular restoration testing? |
| Crisis Management | Art. 21(2)(c)Is there a crisis management framework with defined escalation procedures, communication plans, and designated crisis management team? | Art. 14(1)–(2)Are ICT crisis communication plans documented, defining internal and external notification procedures, roles, and responsible disclosure policies? |
| Third-Party Risk Management | Art. 21(2)(d)Is there a documented supply chain security policy covering ICT product and service procurement, with security requirements for suppliers? | Art. 28(2)Has the management body approved an ICT third-party risk strategy that is aligned with the overall ICT risk management framework and reviewed at least annually? |
| Supplier Due Diligence | Art. 21(2)(d)Do you assess the cybersecurity posture and practices of direct suppliers and service providers before entering into agreements? | Art. 28(4)Is thorough due diligence and risk assessment performed before entering into new ICT third-party arrangements, particularly for critical or important functions? |
| Supplier Contracts | Art. 21(2)(d)Do supplier contracts include cybersecurity requirements, incident notification obligations, and audit/assessment rights? | Art. 30(2)(a)Do ICT third-party contracts include clear service level agreements (SLAs) with quantitative performance targets, monitoring measures, and consequences for non-compliance? Art. 30(3)(e)Do contracts for critical or important ICT services include unrestricted rights of audit and inspection, including on-site access and use of pooled audits? |
| Supplier Monitoring | Art. 21(2)(d)Are supply chain risks and supplier cybersecurity performance monitored on an ongoing basis, with periodic re-assessment? | Art. 28(5)Are critical or important ICT third-party providers subject to continuous monitoring and formal performance reviews at least annually? |
| Risk Assessment | Art. 21(2)(a)Is there a formal, documented risk analysis methodology that identifies and assesses cybersecurity risks to network and information systems? | Art. 8(2)–(6)Is there a formal ICT risk identification and assessment process performed at least annually, after significant changes, and after major ICT incidents? |
| Information Security Policy | Art. 21(2)(a)Has the management body approved a comprehensive information security policy covering all network and information systems, reviewed at least annually? | Art. 9(1)–(2)Are comprehensive ICT security policies and standards documented, approved by management, communicated to all staff, and reviewed regularly? |
| Security Awareness Training | Art. 20(2), Art. 21(2)(g)Is there a cybersecurity awareness and training programme for all staff, including management body members, with regular refresher sessions? | Art. 13(6)Is there an ICT security awareness and training programme covering all staff (including management) that is updated regularly and includes DORA-specific obligations? |
| Change Management | Art. 21(2)(e)Is there a formal change management process for network and information systems that includes security impact assessment and testing? | Art. 9(4)(e)Are ICT change management procedures in place to ensure controlled, tested, and approved modifications to ICT systems and applications? |
| Security Testing | Art. 21(2)(f)Are there defined policies and procedures to assess the effectiveness of cybersecurity risk-management measures, including regular security testing? | Art. 24(1)–(2)Have you established a digital operational resilience testing programme that is risk-based, covers critical ICT systems, and is reviewed at least annually? |
| Penetration Testing | Art. 21(2)(f)Are there defined policies and procedures to assess the effectiveness of cybersecurity risk-management measures, including regular security testing? | Art. 25(1)Are penetration tests conducted at least annually on critical ICT systems, simulating real-world attack scenarios? |
| Breach Notification | Art. 23(4)(a)–(b)Can your organisation submit an early warning to the CSIRT within 24 hours and an incident notification within 72 hours of becoming aware of a significant incident? | Art. 19(4)(a)Can your organisation submit initial incident notifications to the competent authority within 4 hours of classifying an ICT incident as major? |
| Human Oversight | Art. 20(1)Does the management body receive regular (at least quarterly) reports on cybersecurity risk posture and treatment progress? | Art. 5(1)–(2)Has the management body defined, approved, and assumed ultimate responsibility for an ICT risk management framework with clear roles, responsibilities, and reporting lines? |
