DORA implementation across 5 pillars: ICT risk management, incident management, resilience testing, ICT third-party risk management and information sharing — structured and prioritised.
Pillars 1-3: Risk management, incidents and testing
Pillar 1 — ICT risk management (Art. 5-16): document the ICT risk management framework, train and involve the management body, carry out ICT risk assessment, implement protective measures and monitoring. Pillar 2 — ICT incident management (Art. 17-23): incident classification procedure per EBA RTS, reporting processes for 4h/72h/1-month deadlines, maintain an incident register. Pillar 3 — Digital operational resilience testing (Art. 24-27): annual vulnerability assessments, penetration tests for critical systems, TLPT (Threat-Led Penetration Testing) for significant entities.
ICT third-party risk management (Pillar 4) is the most complex and time-consuming pillar. 360TPRM covers it completely — and should therefore be implemented first.
Pillars 4-5 and a prioritisation recommendation
Pillar 4 — ICT third-party risk management (Art. 28-44): build an information register of all ICT providers (EBA-compliant format), roll out 360TPRM for due diligence and continuous monitoring, identify and report critical providers, document exit strategies, check contracts against DORA Art. 30 minimum requirements. Pillar 5 — Information sharing (Art. 45): voluntary participation in information-sharing arrangements, ISAC membership depending on sector. Prioritisation: Pillar 4 first (highest effort, accelerated by 360TPRM), then Pillar 1, then 2 and 3.
Companies that haven't yet started DORA implementation are already behind. BaFin and the EBA will actively examine compliance.
FAQ
Start DORA implementation with 360TPRM
See in a 45-minute demo how 360TPRM specifically meets your requirements.
Request free demo →