DORA in Control

A Practical Guide to Achieve Enhanced Digital Operational Resilience

A study report by NOREA

Authors:

S. Gangaram Panday – Schuberg Philis

J. Oschmann – Schuberg Philis

©2024 NOREA, All rights reserved

PO box 242, 2130 AE Hoofddorp
Phone: +31 (0) 88 4960 380
The Netherlands
e-mail: norea@[Link]

DORA IN CONTROL
Taskforce participants

The study report and framework were reviewed by the following members of the NOREA DORA Taskforce:

Name Role Company

Harry Boersen Director Tech Advisory Yaworks
Danny Bos Senior manager Cybersecurity & Privacy Eraneos
Ibrahim Dogan Register IT-Auditor Validacy
Otto Hulst Beleidsadviseur Pensioenfederatie
Arno Kroese Director IT Assurance & Advisory KPMG
Marvin Kruin Register IT-Auditor MNK Risk, Audit & Advisory Services
René Zendijk Head of Internal Audit Scildon
Shairesh Algoe CISO Quantum Gateway Foundation
Manager IT Security BNG Bank
For the full member list and more content created by the Taskforce, please see [Link]

Endorsements of the study report and framework

This study report and the control framework presented in this paper are endorsed by the following
financial industry associations:

The study report and Dora in control framework have been shared with the DNB and .. The
supervisory authorities provided the following joint response:

“DNB and AFM took note of the framework prepared by NOREA to provide guidance to the
industry on practical implementation of DORA. DNB and AFM did not contribute to its
development. Nor has the framework been assessed by DNB and AFM in terms of content.
However, the development of such frameworks is in line with previous calls from DNB and
AFM to work together within the sector to increase the overall cyber resilience of the sector
and, if desired, to mutually develop and update standards that can contribute to this. DNB and
AFM stress that complying with applicable laws and regulations is at all times a responsibility of
the institution. No confidence can be derived from the use of such a framework that parties
thereby act in line with laws and regulations.”

The DORA in control framework presented in this study report was developed in collaboration with Schuberg Philis.

DORA IN CONTROL
Table of contents

1 Introduction 5
1.1 Motivation 5
1.2 Executive summary 6

2 Background on DORA 7
2.1 From security to resilience 7
2.2 European digital strategy 7
2.3 Regulating digital operational resilience 8
2.3.1 What DORA aims to achieve 8
2.3.2 How DORA aims to achieve its objectives 8
2.3.3 The role of RTS and ITS 9
2.3.4 The DORA-NIS2 relationship 10

3 DORA’s approach 11
3.1 Principles-based 11
3.2 Opportunities 12
3.3 Challenges 13

4 DORA in control framework 15

4.1 Intended purpose 15
4.2 How to implement DORA in four steps 15
4.3 Constructing the framework 15
4.4 Key features 16
4.5 Engineering perspective 17
4.6 Mapping toward the DNB Good Practice for Information Security 17
4.7 The control framework 20

5 Conclusion 43

DORA IN CONTROL
1 Introduction
1.1 Motivation

A rapidly evolving landscape of digital threats has hastened the already urgent need for organizations to have
robust, adaptable frameworks that ensure operational resilience. Financial institutions, in particular, are facing
unprecedented challenges not only from cyberthreats, but also from the complex regulatory environment
designed to safeguard their operations.

One such regulation, the Digital Operational Resilience Act (DORA), introduced by the European Union (EU), is
a landmark initiative aimed at enhancing the digital operational resilience of the financial sector. However, the
more DORA stakeholders we engage with, the more it has become clear that the act’s requirements
sometimes present significant interpretation challenges for financial institutions.

We were motivated to develop the DORA in control framework upon witnessing the difficulties that financial
institutions face in translating the act’s regulations into practical, actionable measures. Adding to the
complexity is the financial sector’s growing reliance on digital systems, compounded by the increasingly
interconnected nature of global finance. As a result, a relatively small operational disruption can have far-
reaching consequences. Moreover, the importance of compliance is heightened by the potential societal
impact of digital failures, which can extend beyond individual institutions to disrupt services essential to the
public.

At the time of writing, no comprehensive framework exists to guide financial institutions in effectively
navigating DORA’s requirements. While DORA is a monumental step toward safeguarding the financial sector
and it does give detailed requirements, the act is composed in a way that leaves room for interpretation. With
this in mind, we set out to construct a framework that simplifies all the legal and technical complexities. Our
goal was to turn DORA’s regulatory requirements into practical, actionable measures that financial institutions
can understand and implement.

For readers interested in the broader context of DORA and digital resilience, the full report provides valuable
background. For those eager to begin the implementation process, focusing on Chapter 4 and the consolidated
controls therein presents a clear path forward.

We envision the DORA in control framework as a living tool, capable of evolving in response to both regulatory
changes and emerging digital risks. Working together to ensure that digital operational resilience is not only a
regulatory requirement but a cornerstone of sustainable financial operations in a digital world, we encourage
feedback and engagement from stakeholders across the financial sector.

From the authors,

Sandeep Gangaram Panday - sgangarampanday@[Link]
Jeremy Oschmann – joschmann@[Link]

DORA IN CONTROL
5/43
1.2 Executive summary

The Digital Operational Resilience Act (DORA) came into force on 16 January 2023 and will apply as of 17
January 2025. Once DORA applies, organizations operating or providing services for the financial sector will be
expected to have undergone significant changes and be prepared to abide by new requirements. Recognizing
the complexity and challenges associated with interpreting and implementing such provisions, we developed a
practical framework designed to assist institutions in navigating these new regulatory waters.

We are proud to introduce the DORA in control framework, a tool that translates complex legal texts into
actionable, consolidated controls and, as such, helps financial institutions achieve digital resilience. Our
framework is built around three key objectives to enable successful implementation:

1. To simplify and translate DORA so a broader audience can understand its contents and the rationale
behind the regulations.
2. To assist organizations in running DORA gap assessments and preparing related reports for
supervisory authorities.
3. To examine DORA from an engineering perspective, aiming to solve actual root causes of issues in
their information and communication technology (ICT) environment and to help businesses achieve
sustainable operational resilience.

In addition, the DORA in control framework may be of use to organizations falling within the scope of the EU’s
Network and Information Security Directive 2 (NIS2). DORA and NIS2 share the same ambition: to enhance
cybersecurity and operational resilience. Because NIS2 merely outlines high-level goals, however, affected
organizations have been uncertain about what to do and how to
implement it. In contrast, DORA offers specific, detailed rules, many of The full excel version of the 🔗
which are stringent and align with the core principles of the Duty of DORA in control framework is
Care outlined in NIS2. Therefore, we recommend that organizations available on the NOREA website
subject to NIS2 regulations use the DORA control framework as a
at [Link]
resource to help achieve compliance with NIS2.

We encourage you to refer to the framework, download the file, and contribute to keeping the information
relevant and rigorous by sharing your comments and feedback with the authors.

DORA IN CONTROL
6/43
2 Background on DORA
2.1 From security to resilience
In recent years, the focus of information and communication technology (ICT) within the financial sector has
shifted from cybersecurity toward comprehensive resilience. This transition reflects the evolving landscape of
threats and dependencies in an increasingly digital and interconnected market. Historically, the primary
concern for financial institutions had been securing ICT systems against unauthorized access, data breaches,
and cyberattacks. This security-specific approach, while necessary, often fell short of addressing the full
spectrum of risks that could disrupt business operations.

The digital transformation of the financial industry combined with growing threats from criminals and state
actors has heightened the level and complexity of threats overall. Accordingly, today’s resilience strategies
must not only address cyberthreats, but also encompass operational continuity measures across all ICT
services critical to financial stability. After all, financial institutions now rely heavily on ICT systems not just for
transaction processing, but for a myriad of critical business functions, including trading, fraud detection, and
treasury management.

Such dependency on ICT systems means that any failure, whether due to a cyberattacks, technical
malfunction, or another unforeseen event, can have far-reaching consequences. Disruptions can affect the
availability, authenticity, integrity, and confidentiality of financial services, leading to financial losses,
reputational damage, and erosion of customer trust. As these systems have become integral to the day-to-day
operations of financial entities, the potential impact of their disruption has grown exponentially toward an
extinction-level threat for institutions. Moreover, the interconnectedness of the global financial system means
that a failure in one entity can have cascading effects, potentially leading to systemic risks with vast and varied
socioeconomic effects.

This shift aligns with a new focus on ensuring the integrity and availability of services under all conditions,
thereby mitigating the risk of systemic disruptions in the financial sector. In the context of legislation,
resilience refers to the ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses,
attacks, or compromises on systems that use or are enabled by cyber resources.1Such a holistic approach to
resilience can encompass a range of strategies, from cyber defense and ransomware incident response plans
to business operations recoverability strategies, actual recovery testing, and advanced crisis management.

2.2 European digital strategy

The EU unequivocally recognizes the need to promote digital resilience within its broader digital strategy. 2
New legal acts and regulatory frameworks have been introduced to enhance digital resilience and
harmonization across the financial sector. These measures aim to create a robust regulatory environment that
not only enhances the security of ICT systems, but also fortifies the resilience of critical business functions that
depend on them. Examples of legal acts within the EU digital strategy are:

 Digital Operational Resilience Act (DORA)

 Network and Information Security 2 (NIS2) Directive
 Critical Entities Resilience (CER) Directive
 Cyber Resilience Act (CRA)
 Cybersecurity Act

1
[Link]
2
[Link]

DORA IN CONTROL
7/43
  Cyber Solidarity Act

These new regulations mandate that critical entities (entailing their complete ecosystem) establish and
maintain comprehensive resilience strategies, including regular testing, risk management, and governance
protocols. In doing so, the regulations enable the organizations to sustain operations and protect stakeholders
even in the face of significant disruptions.

The emphasis on resilience acknowledges that in a digital age, the question is not if disruptions will occur, but
when. Thus, financial institutions must be prepared to manage and mitigate the impact of such events.
Building resilience into ICT systems and business processes ensures continuity, stability, and confidence in the
financial market, all of which are essential for economic health and public trust.

2.3 Regulating digital operational resilience

In light of the evolving and increasing dependencies on ICT systems, the EU introduced DORA to address
multifaceted risks within the financial sector. DORA marks a significant shift in the EU’s broader regulatory
framework. Now emphasized is the importance of digital operational resilience to safeguard the stability and
integrity of the financial market.

Officially known as Regulation (EU) 2022/2554, DORA is a legislative act intended to ensure that financial
entities within the EU can withstand, respond to, and recover from all types of ICT-related disruptions and
threats. It consolidates and enhances existing ICT requirements, constructing a unified framework for digital
operational resilience across the European financial sector.

Despite previous regulatory efforts undertaken at both national and EU-wide levels, significant gaps and
inconsistencies in addressing ICT risks have prevailed. The European Systemic Risk Board highlighted in a 2020
report3 the systemic vulnerability posed by the high level of interconnectedness and interdependencies within
the financial sector’s ICT systems. These vulnerabilities necessitated a more comprehensive and harmonized
approach to ICT risk management, precisely which DORA aims to provide.

2.3.1 What DORA aims to achieve

DORA specifies numerous requirements to help organizations build and maintain digital operational resilience.
These requirements are centered around five pillars:

1. ICT risk management

2. Incident management, classification, and reporting
3. Digital operational resilience testing
4. Managing of ICT third-party risks
5. Information-sharing arrangements

2.3.2 How DORA aims to achieve its objectives

DORA lays out several key requirements, referred to as level 1 regulations, to achieve its objectives. Described
in the act itself, these requirements are discussed in the context of DORA’s five foundational pillars.

1) ICT risk management – DORA chapter 2 (articles 5 – 16):

3
European Systemic Risk Board, Annual Report 2020,
[Link]

DORA IN CONTROL
8/43
ICT risk management requires financial entities to establish comprehensive frameworks to identify, protect
against, detect, respond to, and recover from ICT-related risks. This first pillar pushes for clear governance,
regular risk assessments, protective measures, detection systems, incident response plans, and continuous
improvement based on past experiences.

2) ICT-related incident reporting – DORA chapter 3 (articles 17 – 23):

ICT-related incident reporting standardizes the process for reporting significant ICT incidents. This second pillar
entails developing criteria to classify incidents, setting up procedures to report them to authorities within
specified timeframes and promoting information-sharing to enhance collective resilience.

3) Digital operational resilience testing – DORA chapter 4 (articles 24 – 27):

Digital operational resilience testing mandates the regular testing of ICT systems to evaluate their robustness.
This third pillar consists of routine testing programs, advanced threat-led penetration testing (where
applicable) to simulate real-world attacks, and using test results to improve system resilience.

4) ICT third-party risk management – DORA chapter 5 (articles 28 – 44):

ICT third-party risk management addresses the risks associated with outsourcing ICT services. This fourth pillar
specifies that financial entities must perform thorough due diligence before engaging third-party providers,
ensure that contractual agreements include resilience and security provisions, continuously monitor third-
party performance, and manage risks related to overreliance on a limited number of providers.

5) Information-sharing – DORA chapter 6 (articles 45):

Information-sharing refers to the exchange of threat intelligence and best practices among financial entities
and authorities. This fifth pillar promotes participation in collaborative networks for exchanging information
and coordinating responses during incidents to improve overall resilience.

In total, DORA consists of 64 articles, 41 of which fall within these five pillars. The other 23 articles do not
explicitly address the duties of financial entities. They focus more on background information (scope of
application, competent authorities, penalties, delegated acts, transitional and final provisions, and
amendments).

2.3.3 The role of RTS and ITS

The main text of DORA is supplemented by important technical detail in a body of secondary legislation,
referred to as level 2 regulations. The three European supervisory authorities (ESAs) were jointly appointed to
draft these standards. The ESAs consist of the European Banking Authority (EBA), the European Insurance and
Occupational Pensions Authority (EIOPA), and the European Securities and Markets Authority (ESMA).

These technical standards consist of two types:

 Regulatory technical standards (RTS), of which there are eight

 Implementation technical standards (ITS), of which there are two

Development of the RTS and ITS was separated into work on two sets of documents. The first set was
submitted to the European Commission (EC) on 17 January 2024. The four RTS documents in this first set were
published in the Official Journal of the European Union on 25 June 2024, signaling their official adoption. The
ITS undergo a different adoption process, so the single ITS in this first set is expected to be adopted by the EC
at a later date.

The first set consists of the following documents:

DORA IN CONTROL
9/43
  RTS on ICT risk management framework (part of DORA’s first pillar)
 RTS on simplified ICT risk management framework (first pillar)
 RTS on criteria for the classification of ICT-related incidents (second pillar)
 ITS to establish the templates for the register of information (fourth pillar)
 RTS to specify the policy on ICT services performed by ICT third-party providers (fourth pillar)

The second set, which was submitted to the EC in two parts, on 17 July 2024 and 26 July 2024, consists of the
following documents:

 RTS on content, timelines, and templates on incident reporting (part of DORA’s second pillar)
 ITS on content, timelines, and templates on incident reporting (second pillar)
 RTS on subcontracting of critical or important functions (fourth pillar)
 RTS on oversight harmonization (fourth pillar)
 RTS on threat-led penetration testing TLPT (third pillar)

For links to the latest versions of the RTS and ITS, please see [Link]

2.3.4 The DORA-NIS2 relationship

Both being key EU legislative frameworks, the NIS2 and DORA not only share in their objective to enhance
cybersecurity and operational resilience, but also reference each other. DORA has lex specialis status vis-à-vis
NIS2, meaning that DORA serves as a specialized set of rules that take precedence over the more general goals
of NIS2.

Some key differences between the two frameworks are that:

 NIS2 targets a much broader sectoral scope; DORA targets the financial sector specifically.
 NIS2 provides overarching generic cybersecurity requirements; DORA provides detailed requirements
for the financial sector.
 NIS2 is a directive that must undergo transposition into national law (in the Netherlands, it has been
adopted as the Cyberbeveiligingswet); DORA is an EU regulation, which therefore has immediate
applicability for all EU member states.

While NIS2 is not a principal topic for this study report, it merits mention. We believe that the DORA in control
framework may also be of use for organizations that fall within the scope of NIS2. Because there remains a lack
of detailed NIS2 controls, organizations continue to face uncertainty about what to do and implement to
achieve NIS2 compliance.

It is notable that NIS2 takes an all-hazards approach in its article 21.1. In this context, an all-hazards approach
means organizations must enhance their overall security posture and operational stability through adopting a
broad, inclusive strategy for risk management and resilience. This must ensure they are prepared for any
potential source of disruption (all hazards), be it in the form of a cyberattacks, natural disaster, technical
failure, or another unforeseen event.

In sum, knowing that the requirements in DORA are stricter than those of NIS2, we advise organizations
affected by NIS2 regulations to consider implementing the DORA in control framework.

DORA IN CONTROL
10/43
3 DORA’s approach
3.1 Principles-based
DORA embodies a shift in regulatory thinking, moving beyond mere compliance toward a principles-based
approach to digital resilience. To fully leverage the value of DORA, we recommend organizations use it as a
guiding principle for improving operational stability and security, tailored to the specific risk profiles of critical
business processes and their supporting ICT systems. This perspective ensures that implementation of the act
does not get reduced to a simple compliance exercise, but rather is integrated as a strategic framework for
ongoing resilience.

Article 4 of DORA describes the proportionality principle and specifies two ways of applying it.

1. Principles of proportionality are incorporated in specific articles on ICT risk management (DORA chapter
2), whereby microenterprises are allowed to apply simplified requirements.
2. The implementation and application of DORA requirements can be proportionally based on the financial
institution’s size and overall risk profile as well as the nature, scale, and complexity of services, activities,
and operations (via principles-based regulation).

Principles-based regulation emphasizes risk-based adaptability, which allows financial institutions to tailor
their risk management and resilience strategies to their unique operational contexts. Unlike prescriptive
regulations that dictate specific actions, principles-based regulation encourages entities to take measures and
implement controls that are proportional to the risks they face. This approach recognizes the diversity of
financial institutions and the varying levels of complexity in their ICT environments.

By adopting a principles-based approach, financial institutions can move beyond a checking-the-boxes mindset
of compliance and instead internalize meaningful risk management. This requires a deep understanding of the
institution’s risk profile, identification of critical or important functions, and assessment of the ICT systems that
underpin these functions, while also taking into account the size of an institution.

Tailoring measures to risk profiles

Central to DORA’s principles-based approach is the idea that measures and controls should be proportional to
the risk profile of business processes and ICT systems. This means that institutions must conduct thorough risk
assessments to identify and prioritize their most critical assets and processes. Level of protection, detection,
response, and recovery mechanisms should then be aligned with the potential impact of risks on these assets.

For example, a payment processing system that handles a large volume of transactions daily would require
more stringent controls and resilience measures compared to a less critical internal administrative system. This
targeted approach ensures that resources are allocated efficiently and the most significant risks are clear,
thereby enabling the most important risks to mitigated effectively.

Dynamic and continuous improvement

A principles-based approach also emphasizes the dynamic nature of risk management and resilience. Financial
institutions must continuously monitor and reassess their risk environments, adapting their controls and
measures as new threats and vulnerabilities emerge. An ongoing process of improvement is important for
maintaining resilience in a constantly evolving digital landscape.

DORA encourages institutions to foster a culture of continuous learning and adaptation. By regularly testing
resilience measures, conducting scenario analyses, and learning from past incidents, financial institutions can

DORA IN CONTROL
11/43
enhance their preparedness and response capabilities. This proactive stance not only fulfills the regulatory
expectations of DORA, but also strengthens an institution’s overall security posture.

Integrating resilience into business strategy

Viewing DORA as a principles-based framework necessitates integrating digital operational resilience into a
broader business strategy. Resilience should not be an afterthought or a separate compliance function, but
rather an integral part of strategic planning and decision-making processes. Integration ensures that resilience
considerations are embedded in every aspect of the institution’s operations, from product development to
customer service.

The management body play a critical role in integration. These individuals must champion the importance of
resilience, allocate appropriate resources, and ensure that resilience objectives are aligned with the
institution's strategic goals. A top-down commitment is essential for creating a resilient organizational culture
that prioritizes security and operational stability.

Moving beyond compliance

Ultimately, DORA should be seen as a catalyst for transforming how financial institutions approach digital
operational resilience. By embracing its principles-based philosophy, institutions can move beyond the narrow
focus of regulatory compliance and adopt a holistic strategic approach to risk management. This shift not only
enhances compliance, but also drives operational excellence, innovation, and customer trust.

3.2 Opportunities
While regulatory requirements are often experienced as burdensome, DORA offers financial institutions a
significant opportunity to enhance their digital operational resilience. Rather than merely being a compliance
mandate, the act provides a strategic framework that can drive improvements other than risk management
and ICT operational stability. It can also boost customer trust and overall competitiveness across the financial
sector.

Customer trust

For a financial industry that operates in today’s digital age, trust and confidence are paramount. By adhering to
DORA’s stringent resilience requirements, financial institutions can demonstrate their commitment to
safeguarding customer assets and ensuring uninterrupted service. This commitment to resilience and security
enables trust among customers, partners, and stakeholders. As a result, financial institutions can enhance their
reputation, build stronger customer relationships, and create a loyal customer base that values the
institution’s dedication to digital resilience.

Competitive advantages

Compliance with DORA necessitates the adoption of advanced technologies and innovative solutions to
manage ICT risks effectively. Financial institutions that embrace these requirements as an opportunity for
digital transformation can gain a competitive edge. By leveraging cutting-edge cybersecurity tools, automated
risk management systems, and sophisticated resilience-testing methods, institutions meet regulatory
standards while also positioning themselves as leaders in digital resilience. Again, a proactive stance can
attract customers who prioritize security and reliability, thereby driving business growth and market
differentiation.

Recoverability

DORA IN CONTROL
12/43
DORA offers a crucial opportunity for organizations to enhance their digital recoverability by requiring robust
recovery mechanisms and diligent testing to ensure continuous service availability. By complying with DORA's
requirements, financial institutions can swiftly restore critical functions, minimize downtime, and protect data
integrity during cyber incidents or system failures. This not only ensures regulatory compliance, but also
transforms operational resilience into a strategic advantage.

3.3 Challenges
Implementing DORA presents numerous challenges for financial institutions. While DORA’s principles-based
approach offers flexibility and adaptability, translating its broad requirements into actionable measures can be
complex. This can make it difficult for management to navigate and implement effectively.

Multifaceted interpretation

One of DORA’s primary challenges is its requirement for interpretation across various domains. Legal experts
might focus on the precise wording of the regulation, emphasizing compliance and avoidance of penalties. IT
professionals may prioritize technical aspects, such as system security and incident response mechanisms.
Business managers are likely to be concerned with maintaining operational efficiency and aligning resilience
measures with broader strategic goals. Balancing these perspectives to form a cohesive and actionable
strategy can pose challenges for many institutions.

Translating principles into actionable measures

DORA’s principles-based nature, while offering flexibility, can also be a double-edged sword. The lack of
prescriptive guidelines means that financial institutions must develop their own measures based on their
unique risk profiles. However, this requires a deep understanding of both the regulatory requirements and the
specific operational risks faced by the institution.

For management, translating these broad principles into specific, actionable measures can be daunting. It
involves not only identifying and assessing risks, but also determining the appropriate controls and resilience
strategies. This process demands significant expertise and resources, which can be a barrier for many
institutions, particularly smaller ones with limited capacity.

Management's role and engagement

Management plays a critical role in driving the implementation of DORA. However, translating technical and
legal requirements into strategic business actions is a complex task that requires strong leadership and
engagement. Management must not only understand the regulatory landscape, but also be able to articulate
the importance of resilience and security to all stakeholders.

Engaging senior management and ensuring their commitment to digital operational resilience is therefore
crucial. This includes securing the necessary resources, setting clear priorities, and fostering a culture that
values and supports resilience efforts. Without strong leadership and engagement, the implementation of
DORA can become disjointed and ultimately ineffective.

Developing a unified framework

Given the diverse interpretations and the need for cross-functional collaboration, developing a unified
framework for DORA compliance is essential but nonetheless challenging. A fragmented approach, wherein
different departments work in silos, can lead to inconsistencies and gaps in resilience measures.

Financial institutions need a comprehensive framework that integrates legal, IT, and business management
perspectives into a cohesive strategy. This framework should facilitate clear communication, consistent
interpretation of regulatory requirements, and coordinated action across all levels of the organization.

DORA IN CONTROL
13/43
Wanting to overcome these challenges is precisely why we developed the DORA in control framework. This
solution is designed to bridge the gap between the act’s high-level principles and the practical, actionable
measures required for compliance and resilience. It offers clear controls to help financial institutions navigate
the complexities of DORA, ensuring that they can achieve compliance while enhancing their digital operational
resilience.

DORA IN CONTROL
14/43
4 DORA in control framework
4.1 Intended purpose
Financial institutions have been struggling with the sheer complexity of Digital Operational Resilience Act
(DORA), leading to challenges in implementing effective controls. Through conversations that we held with
industry professionals and our extensive market research, a recurring theme emerged: the need for an
actionable framework that simplifies DORA’s intricate requirements. To this end, the primary objective of the
DORA in control framework is to transform the act’s legal complexities, along with its 10 RTS and ITS (see
section 2.3.3), into clear, actionable strategies for financial institutions.

Ultimately, the framework seeks to make DORA accessible and actionable, ensuring that financial institutions
can confidently navigate the regulatory landscape while fortifying their operations against digital threats. In
constructing the framework, we kept close to the act’s actual requirements and avoided creation of any
additional ones to ensure that framework maintains the focus purely on the requirements in the act itself

4.2 How to implement DORA in four steps

DORA implementation can be done successfully through below 4 step approach, which can be integrated in
the DORA projects at institutions:

1. When implementing DORA, the first step is to thoroughly assess the organization’s critical and/or
important functions (article 8.1). This necessitates a comprehensive overview of all key processes and
identifying the ICT infrastructure that supports and is essential to the operations of these processes,
including third-parties.
2. The next step is to perform a risk assessment on this ICT infrastructure. The assessment helps
establish a risk profile and prioritize areas that require attention.
3. Following the risk assessment, the next step would be to deploy the DORA in control framework to
conduct a gap analysis. Such analysis identifies where the institution currently stands vis-à-vis DORA
requirements and highlights areas where improvements are needed.
4. Based on the gap analysis findings, a final step should be to develop a plan or roadmap, focusing on
solutions and mitigating measures to address the identified gaps and root causes and ensure
compliance with DORA.

As emphasized in DORA, it is important that the DORA implementation projects are executed directly under
responsibility and supervision of the management body. Therefore continuous communication with
management is essential to keep them responsible and engaged throughout the process. As included in step 1,
equally important is managing relationships with critical third parties, especially since financial institutions
increasingly rely on outsourced IT services. The chain of contracting becomes vital for DORA compliance,
making it imperative to ensure that all third-party relationships align with the institution’s operational
resilience and regulatory obligations.

4.3 Constructing the framework

In developing the DORA in control framework, our focus was explicitly on the act’s requirements for financial
institutions. We therefore excluded any optional requirements or those referring to supervisory, oversight, or
background information.

Construction of the framework began with a thorough analysis of the primary (level 1) and secondary (level 2)
legislative requirements. Our first step was to distill the complex legal language into a more digestible format
for all stakeholders. Once the requirements were put into simpler terms, we employed a mix-and-match
process to identify overlapping topics and requirements. This allowed us to consolidate individual
requirements into actionable controls that could be logically grouped under recognizable domains, offering
improved efficiency when performing a gap assessment and implementation. Each control was cross-

DORA IN CONTROL
15/43
referenced with the specific DORA articles from which it was derived, enhancing both transparency and
traceability.

Our process resulted in a framework consisting of eight control domains, 28 sub-domains, and 95 individual
controls. For a visualization, see figure 1. During the framework development, IT risk managers, CISOs, and
auditors conducted a thorough review process to ensure the quality of the framework. We also created a
detailed worksheet to document the translation process, providing a clear audit trail for how the framework
evolved from DORA’s legal texts to practical controls.

To further support implementation, we integrated the maturity model from the Dutch Central Bank (DNB)
Good Practice for Information Security into the framework along with a dashboard that enables users to
visualize the implementation and communicate about its progress.

Figure 1: DORA in control framework

4.4 Key features

The DORA in control framework has several key design features tailored to address the act’s complexities while
providing practical, actionable solutions.

 Simplified legal interpretation: One of the framework’s most notable features is the translation of
DORA’s complex legal jargon into more accessible language.
 Consolidated actionable controls: The framework consolidates individual DORA requirements into a
set of cohesive, actionable controls. Each control is cross-referenced with specific DORA articles,
which enhances transparency and facilitates traceability.
 Integration of the DNB maturity model: To assist institutions in tracking their progress, the
framework incorporates the DNB maturity model from the DNB Good Practice for Information
Security.
 Visual progress dashboard: The framework incorporates a dashboard to provide a visual
representation of implementation progress. This feature offers a clear, intuitive way for institutions to
track their advancement and communicate progress to stakeholders, including management and
regulatory bodies.
 Mapping of DNB controls: The framework includes a mapping of controls in the DNB Good Practice
for Information Security to DORA controls, addressing the need to transition from existing standards

DORA IN CONTROL
16/43
 to the new regulatory framework. This feature is particularly valuable for institutions accustomed to
DNB controls, though is also crucial given the DNB’s decision to phase out its own controls in favor of
DORA.4 The mapping helps institutions align their practices with DORA requirements while
maintaining continuity in their compliance efforts.

4.5 Engineering perspective

The engineering perspective used to build the DORA in control framework focused on dissecting the act’s
complexities and utilizing expert input to solve the challenges that arise from it. DORA is principles-based,
which offers flexibility but also requires interpretation to enable effective application of those principles. We
believe this engineering perspective is crucial for the successful implementation of DORA within financial
institutions, as it emphasizes the importance of understanding underlying complexities and root causes while
taking a structured and systematic problem-solving approach.

To further enhance the proper implementation of the DORA controls within the institutions, we advise
institutions to add a column to document their specific control implementation choices. These should be made
based on the institutions context, proportionality and risk profile. To do this from an engineering perspective,
we recommend the use of the 5W/1H method. This method consists of asking 6 critical questions for proper
problem analysis and solution identification:

 WHAT: What controls are needed? What assets or processes need protection? What are the
potential consequences of not doing something?
 WHO: Who is responsible for implementing and maintaining the controls? Who is involved or
affected (users, customers, or third parties)?
 WHERE: Where will the controls be implemented (location or asset)? Where should sensitive data
and resources be stored securely?
 WHEN: When should the controls be implemented? When will updates and reviews of the controls
occur? When will training and education for users take place?
 WHY: Why are these controls necessary? Why were these specific controls chosen? Why did existing
measures fail?
 HOW: How will the controls be implemented and enforced? How will the effectiveness of the
controls be measured? How will issues or breaches be handled?

4.6 Mapping toward the DNB Good Practice for Information Security
In the Netherlands, many financial institutions are used to implement and report on cyber security based on
the DNB Good Practice for Information Security from the Dutch Central Bank5. Therefore, the DORA in control
framework is mapped to the controls in the DNB Good Practice for Information Security 2023. This mapping
shows that 44% of the DORA controls are already accounted for in the DNB controls, while 41% are partly
mapped, and 15% are completely new. For a visualization, see figure 2.

4
[Link]
5
[Link]

DORA IN CONTROL
17/43
Figure 2: Mapping result between DORA in control framework and DNB Good Practice for Information Security 2023

DORA controls that are mostly covered by DNB controls (50%+ overlap) fall within the following domains:

1) Software and systems development

2) Operational management
3) Resilience testing

Largest gaps in correspondence between DORA controls and DNB controls fall within the following domains:

1) Continuity management
2) Security management
3) Third-party risk management
4) Incident management

For a visualization of how all eight domains overlap, please see figure 3.

DORA IN CONTROL
18/43
Figure 3: DNB Good Practice for Information Security 2023 mapping to the DORA in control framework per domain

DORA IN CONTROL
19/43
4.7 The control framework
Governance and Risk Management

GRM.1 Management Responsibilities

DORA IN CONTROL
20/43
GRM.2 Risk Management Framework

DORA IN CONTROL
21/43
GRM.3 Risk Management Framework

GRM.4 (Internal) ICT Audit

DORA IN CONTROL
22/43
Operational Management

OM.5 Asset Management

DORA IN CONTROL
23/43
OM.6 Change Management

OM.7 ICT Operations

DORA IN CONTROL
24/43
Continuity Management

CM.8 Backup Management

DORA IN CONTROL
25/43
CM.9 Response and Recovery

DORA IN CONTROL
26/43
Incident Management

IM.10 Incident Classification

DORA IN CONTROL
27/43
IM.11 Incident Management

DORA IN CONTROL
28/43
Software and Systems Development

SSD.12 Acquisition, Development, and Maintenance

DORA IN CONTROL
29/43
SSD.13 Project Management

DORA IN CONTROL
30/43
Third-party Risk Management

TPRM.14 Third-party Due Diligence and Selection

DORA IN CONTROL
31/43
TPRM.15 Third-party (Standard) Contract Management

DORA IN CONTROL
32/43
TPRM.16 Third-party (Critical) Contract Management

DORA IN CONTROL
33/43
TPRM.17 Third-party Risk Management

DORA IN CONTROL
34/43
TPRM.18 Subcontracting Management

DORA IN CONTROL
35/43
Resilience testing

RT.19 Digital Operational Resilience Testing

RT.20 Threat-led Penetration Testing (TLPT)

DORA IN CONTROL
36/43
Security Management

SM.21 Architectural and Network Security

DORA IN CONTROL
37/43
SM.22 Security Monitoring & Log Management

DORA IN CONTROL
38/43
SM.23 Data and (Legacy) System Security

DORA IN CONTROL
39/43
SM.24 Encryption and Cryptography

SM.25 Identity and Access Management

DORA IN CONTROL
40/43
SM.26 Physical and Environmental Security

SM.27 Security Awareness

DORA IN CONTROL
41/43
SM.28 Security Awareness

DORA IN CONTROL
42/43
5 Conclusion
The DORA in control framework offers a crucial tool for organizations aiming to enhance their operational
resilience and to comply with multiple regulatory standards.

Our study report underscores the importance of a structured four-step approach to DORA readiness:

1. Assessing the organization’s critical and/or important functions. This necessitates a comprehensive
overview of all key processes and identifying the ICT infrastructure (including third-parties) that
supports and is essential to the operations of these processes.
2. Performing a risk assessment on this ICT infrastructure. The assessment helps establish a risk profile
and prioritize areas that require attention.
3. Performing a gap assessment based on the DORA in control framework. Such analysis identifies where
the institution currently stands vis-à-vis DORA requirements and highlights areas where
improvements are needed.
4. Developing a plan or roadmap, focusing on solutions and mitigating measures to address the
identified gaps and root causes and ensure compliance with DORA.

Having performed the above four steps will not only help financial institutions on their journey toward digital
operational resilience, but should also prove useful in fulfilling the oversight expectations of supervisory
authorities. We have already heard supervisory announcements stating that organizations will be requested to
submit gap assessments and roadmaps for compliance.

What’s more, applying an engineering’s perspective to the DORA in control framework – its construction and
its implementation – is essential for addressing the actual root causes of ICT issues rather than merely
checking boxes for compliance. By fostering a culture of problem-solving and innovation, we move beyond
surface-level fixes toward sustainable solutions that enhance both resilience and efficiency.

Taking the systematic, holistic approach we have outlined, organizations can achieve DORA compliance while
also cultivating a proactive framework that enables them to navigate the increasingly complex regulatory
landscape. This will also ensure they stay well-equipped to face the future and, in particular, its many ICT
challenges and opportunities.

To further support organizations with DORA compliance, the NOREA Dora taskforce plans to continue
publishing more guidelines for effective and efficient implementation. For the latest guidelines, please see
[Link]

DORA IN CONTROL
43/43