DORA Implementation: Structured Approach for Financial Institutions

This page describes the overall path of a DORA implementation, while a dedicated gap analysis provides the actual assessment methodology used to identify gaps between current and required state. In practice, the gap analysis is usually the first step within the implementation path described here, not a separate, alternative approach.

Common phases are a gap analysis against the five DORA pillars, closing prioritized gaps, building or updating the ICT third-party register, establishing the required testing programs, and finally transitioning into ongoing operation with regular review. The order can vary depending on the starting point, especially if parts of the requirements are already met.

Software can significantly ease maintaining the third-party register, document management, and tracking open actions, but it doesn't replace the substantive judgment on which requirements are relevant in your own context. It's worth clarifying your process landscape before selecting software, since otherwise a tool often gets introduced that doesn't match actual workflows.

Audits of critical ICT third-party providers should be planned as a fixed part of third-party risk management, not as an afterthought. In practice, it's advisable to secure audit rights during contract negotiation, since enforcing them retroactively on existing contracts is significantly harder.

Beyond someone responsible with an overview of ICT risk management, capacity is usually needed from IT, procurement or contract management for third-party renegotiation, and compliance or legal for regulatory interpretation. Effort is often underestimated because it spreads across multiple departments rather than sitting with one central owner.

The most common delay is third-party contract renegotiation, since that depends on external counterparties' response speed and is hard to accelerate internally. A second common cause is unclear ownership: when ICT risk management responsibility stays ambiguously split between IT and compliance, decisions stall instead of getting made quickly.