European Union
DORA compliance, made simple
ComplianceDesk gives you 13 pre-built DORA controls, an evidence vault, audit-ready reports, and reminders before anything falls overdue — so proving DORA compliance stops being a spreadsheet exercise.
Every DORA control, organised for you
The real control library ComplianceDesk seeds the moment you activate DORA — 13 controls across 5 categories.
ICT Risk Management Framework
- DORA-1.1 ICT risk management framework approved and owned by the management body
- DORA-1.2 ICT risk appetite and tolerance thresholds defined
- DORA-1.3 ICT asset inventory and business impact analysis maintained
- DORA-1.4 ICT business continuity policy and disaster recovery plans tested
ICT-Related Incident Reporting
- DORA-2.1 Initial notification submitted within 4 hours of classifying an incident as major
- DORA-2.2 Intermediate report submitted within 72 hours of the initial notification
- DORA-2.3 Final report submitted within one month of the latest intermediate report
Digital Operational Resilience Testing
- DORA-3.1 Digital operational resilience testing programme conducted
- DORA-3.2 Threat-led penetration testing (TLPT) conducted at least every three years
ICT Third-Party Risk Management
- DORA-4.1 Register of Information for ICT third-party arrangements maintained
- DORA-4.2 ICT third-party contracts include DORA-required provisions
- DORA-4.3 Concentration risk from critical ICT third-party providers assessed
Information Sharing
- DORA-5.1 Participation in cyber threat information-sharing arrangements considered
Frequently asked questions
How many controls does ComplianceDesk track for DORA?
13, organised into 5 categories, ready to assign to an owner as soon as you activate the framework.
Can I track DORA alongside other frameworks?
Yes — most teams activate several frameworks at once. Controls that overlap across frameworks can share the same evidence, so you don't collect the same document twice.
How long does it take to set up DORA in ComplianceDesk?
Activating DORA instantly seeds its full control library. Most teams assign owners and get their first controls moving within a day.
Related guides
Other European Union frameworks
See your full compliance picture
131 frameworks, one system of record.