GRCLibrary.ai

Annex

DORA Implementation Annex

This annex describes how a financial entity in scope of the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554) can use the core GRC library to implement the five DORA pillars. The annex maps the library to each pillar, identifies the supplementary supervisory artefacts DORA requires, and notes the obligations specific to critical ICT third-party service providers.

Type
Annex
Version
0.0.16
Date
2026-10-29
Owner
Chief Compliance Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Compliance: Sector-Specific
Review frequency
Annual and upon material DORA Regulatory Technical Standards (RTS), Implementing Technical Standards (ITS), or supervisory guidance change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • Applicability triggers
  • Relationship to NIS2 (lex specialis)
  • Pillar 1: ICT risk management framework (Articles 5 to 16)
  • Pillar 2: ICT-related incident reporting (Articles 17 to 23)
  • Pillar 3: Digital operational resilience testing (Articles 24 to 27)
  • Pillar 4: Managing ICT third-party risk (Articles 28 to 44)
  • Pillar 5: Information and intelligence sharing (Article 45)
  • Library gaps requiring additional documentation
  • Framework alignment
  • Limitations

Frameworks it maps to

Related documents