Reference guides to the register of information, the simplified framework in Article 16, the criticality measurement the regulation never defines, and the mapping to ISO 27001. Written against the primary text, kept current, free to use.
Book a scoping callEach guide is written against Regulation (EU) 2022/2554 and the implementing and delegated acts under it, with the article and template references stated so you can check them.
The DORA requirements set against the ISO 27001 clauses and Annex A controls, so an existing ISMS can be read as evidence where it genuinely is, and the gaps show up as gaps.
Open the mapping → Guide and downloadThe 15 ITS templates of Commission Implementing Regulation (EU) 2024/2956 and all 117 fields, with the data-collection sheet to gather them in, the corrigendum renumbering applied, and the three uncorrected errors in the official text marked where they bite.
Read the guide → GuideFour ICT risk management obligations fall away for small and non-interconnected financial entities. The eligibility tests run on internal figures rather than public data, and the register obligation is not one of the four.
Read the guide → GuideDORA gates 22 of its 41 articles on whether a function is critical or important, and Article 3(22) defines the term without giving a method. The same gap sits under the risk tolerance level in Articles 3 and 31.
Read the guide →Shorter pieces on what the obligations look like once they reach an operating organisation.
What it costs to hold five regulatory frameworks together by hand, and what replaces the spreadsheet.
Read article →Why a governance architecture breaks with every new regulation, and what building the translation layer once changes.
Read article →A short call establishes your scope under DORA, whether Article 16 reaches you, and which obligations matter first.
Book a scoping call