What the DORA self-assessment covers
70 requirements in 13 areas, based on Regulation (EU) 2022/2554 and its RTS/ITS, including the register of information (Implementing Regulation 2024/2956) and threat-led penetration testing (Delegated Regulation 2025/1190):
- Governance and the ICT risk-management framework
- Identification, protection, detection, response, recovery, backup and redundancy
- ICT incident management, classification and reporting
- Digital operational resilience testing, including TLPT
- Third-party risk: strategy, register of information, contracts, subcontracting, exit plans and critical providers
- Information sharing and interplay with other regulations
The coverage map links each requirement to ISO/IEC 27001:2022 Annex A controls and ISO 22301:2019 clause 8, so it can also support your Statement of Applicability and your business continuity plan.
How it works
Allow 60-120 minutes. Each requirement is scored from 0 to 4; gaps are prioritised P1/P2/P3 and the dashboard shows compliance by area. Answers stay in your browser, no account is needed, and the summary PDF is free. GoToCertify Pro (18 EUR, 45 days, all assessments) adds the full report with action plan, an evidence tracker, comparison with earlier assessments and Excel export. An Italian edition organised by banking business function is also available.
Start the free DORA self-assessment →
Close the competence gap
- DORA Foundation course and the DORA Foundation exam simulator
- ISO/IEC 27001 Foundation for the ICT security controls
- ISO 22301 exam simulators for business continuity
Exams are delivered online through GoToCertify.
The self-assessment is an information tool, not legal advice. Check references against the official texts and the guidance of your competent authority.
