DORA - Regulation (EU) 2022/2554

DORA Readiness Scorecard

Score your financial entity’s readiness against the ten core DORA pillars (in force since 17 January 2025).

How this is calculated

Each of the ten questions is one pillar drawn from DORA’s main chapters: ICT risk management (Art 5-13), incident management and reporting (Art 17-19), resilience testing (Art 24-26), third-party risk (Art 28) and information sharing (Art 45).
Readiness = pillars answered Yes, divided by ten, rounded to a whole percentage. Every pillar carries equal weight.
Colour: below 40% is red, 40% to 74% amber, 75% or more green.
Every pillar answered No is listed as a gap.

Constants the tool uses

Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.

Weight per pillar: Equal (10 percentage points each)
Colour thresholds: Red under 40%, amber under 75%, green from 75%

Worked example

The calculator run on its default inputs:

ICT risk-management framework in place (Art. 6): No
Incident classification + major-incident reporting to the authority (Art. 17-19): No
Digital operational resilience testing programme (TLPT where designated, Art. 24-26): No
Register of ICT third-party arrangements + exit strategies (Art. 28): No
Cyber threat information-sharing arrangements (Art. 45): No
Business continuity, backup & restoration with defined RTO/RPO (Art. 11-12): No
Up-to-date inventory of ICT assets and dependencies (Art. 8): No
Patch and vulnerability management process: No
Digital operational resilience training for staff and management (Art. 13): No
Management body defines, approves and oversees the risk framework (Art. 5): No

0% DORA ready (0/10 pillars)

Gap: ICT risk-management framework
Gap: Incident classification & reporting
Gap: Resilience testing / TLPT
Gap: Third-party register & exit strategies
Gap: Information-sharing arrangements
Gap: BCP, backup & RTO/RPO
Gap: ICT asset inventory
Gap: Patch & vulnerability management
Gap: Resilience training
Gap: Management-body oversight

With every answer at its default of No, the score is 0 of 10 pillars (0%) and all ten are listed as gaps. Each Yes adds 10 points; eight Yes answers (80%) are the first result that turns green.

Sources

DORA - Regulation (EU) 2022/2554 (EUR-Lex) - the pillars above, scope (Art 2), TLPT at least every 3 years (Art 26), application from 17 January 2025 (Art 64)
Commission Delegated Regulation (EU) 2025/301 (EUR-Lex) - content and time limits for major ICT-incident reports

Sources last checked September 2026.

Limitations

A yes/no answer cannot tell a documented framework from one that works, and supervisors test evidence. Proportionality (Art 4) and the simplified regime for small entities (Art 16) mean the same score can be adequate for one firm and not for another; the register of information and TLPT rules have their own technical standards not reflected here. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.