DORA and NIS2 gap checklist

Governance

• Management body has formally approved the ICT risk framework.
• Accountability documented down to named roles.
• Management and board security training delivered and recorded.
• Reporting pack shows control effectiveness, not just project status.

Inventory and risk

• ICT assets mapped to business functions with criticality ratings.
• Risk assessment methodology documented and consistently applied.
• AI systems inventoried and risk-classified where the AI Act applies.
• Dependencies on critical third parties identified end to end.

Incident reporting

• Single severity classification matrix drives all reporting clocks.
• NIS2's 24-hour early warning, 72-hour incident notification and 1-month final report tested end to end (Article 23).
• DORA's 4-hour initial notification (from classification, and within 24 hours of detection), 72-hour intermediate report and 1-month final report tested end to end for major ICT incidents.
• Named individuals responsible for filing, with a deputy.
• Clock start condition defined and understood by the on-call team — DORA's initial-notification clock starts at classification, not detection.

Third-party and resilience

• Register of information maintained for ICT providers, with the annual DORA submission (30 April) tracked as a hard deadline.
• Contracts contain required audit, exit and subcontracting clauses.
• Concentration risk assessed for critical providers.
• Business continuity and recovery objectives tested against real restore times.
• Resilience testing plan documented with findings tracked to closure.