The Digital Operational Resilience Act (DORA) is no longer a distant deadline—it’s here and regulatory oversight at audit stage is a fast-approaching reality for financial services and their critical service providers. By January 2026, firms across the EU must demonstrate to auditors that they can withstand, respond to, and recover from all types of ICT-related disruptions against DORA’s pillars.
But here’s the challenge: while many organisations understand the regulation’s importance, fewer still know where to start. Compliance is not just about meeting a regulatory tick-box—it’s about building operational resilience into the heart of your organisation.
So, if your organisation has not begun to address compliance to The Digital Operational Resilience Act, you need to take the first step; A robust gap analysis.
This blog is your practical starter pack for DORA readiness, helping you understand where you stand today and what needs to change tomorrow.
Why start with a gap analysis?
Think of a gap analysis as your compliance compass. It helps you:
- Benchmark your current ICT risk management practices against DORA’s requirements.
- Identify weaknesses that could leave you exposed in the eyes of regulators—or attackers.
- Prioritise remediation efforts so you focus resources where they’ll have the greatest impact.
- Build a roadmap to compliance, giving leadership and regulators confidence that you’re on track.
Without this step, many organisations risk diving straight into costly tool implementations or process changes without truly knowing if they address the right problems.
The five key areas to assess for DORA
DORA sets out a comprehensive framework, but your gap analysis should at minimum focus on these five areas:
- ICT Risk Management Framework
Do you have clear governance, policies, and reporting lines for ICT risk? DORA expects firms to demonstrate that ICT risks are managed with the same rigour as financial or operational risks.
Here’s the pincher; If you think by being ISO27001 is enough then think again – this only covers parts of the ICT Risk Management Framework (like risk assessment and control implementation), but DORA goes significantly further by embedding resilience across governance, testing, incident response, and third-party oversight.
Starter questions: Are your ICT risk management policies regularly tested and aligned to business objectives? Do you have any oversight to your third parties?
- ICT Incident Reporting
Under DORA, reporting ICT incidents to regulators must follow strict timelines and templates. Many organisations are unprepared for the speed and precision required.
Starter question: Do you have incident detection and escalation processes that allow you to report within DORA’s timelines?
- Digital Operational Resilience Testing
Testing is more than penetration tests. DORA requires advanced threat-led penetration testing (TLPT) for critical functions.
Starter question: Are your testing programs broad enough to demonstrate resilience across all critical ICT services?
- Third-Party Risk Management
DORA places significant emphasis on ICT third-party risk. Critical service providers must meet new contractual and oversight requirements.
Starter questions: Do you have a clear inventory of your critical ICT providers and the controls they must meet? Do you know their own ICT risk management processes?
- Information Sharing
DORA encourages financial entities to participate in information sharing to strengthen collective resilience.
Starter question: Is your organisation part of trusted networks to exchange threat intelligence safely?
Turning gaps into an action plan
Once your gap analysis is complete, the next step is to create a prioritised action plan. This should focus on:
- Quick wins: Controls and processes you can remediate quickly, such as updating policies or clarifying reporting lines.
- Medium-term initiatives: Projects requiring investment or change management, such as enhancing monitoring or building a third-party risk register.
- Long-term transformation: Larger programmes, such as implementing continuous monitoring solutions or preparing for TLPT exercises.
The key is not to attempt everything at once. Regulators will look for a structured, risk-based approach rather than a panicked scramble.
Common pitfalls to avoid
- Treating DORA as a compliance exercise only. The regulation is about resilience, not just reporting.
- Underestimating third-party risk. Critical service providers are firmly in scope, and accountability remains with your organisation.
- Lack of ownership. DORA readiness is not just an IT project—it requires cross-functional collaboration across risk, compliance, operations, and the board.
- Delaying action. With deadlines looming, waiting until 2025 is too late. Gap analysis should be happening now.
- Thinking manual processes still work. DORA requires continual monitoring of these pillars for audit assurance, manual monitoring and spreadsheets will no longer cut it.
Building confidence with continuous monitoring
One of the strongest ways to bridge gaps and demonstrate compliance is through Continuous Controls Monitoring (CCM). By automating evidence collection, mapping controls to frameworks, and tracking compliance in real time, CCM helps you:
- Eliminate manual effort and audit fatigue.
- Prove resilience to regulators with real-time assurance and live DORA dashboards.
- Identify issues before they become reportable incidents.
CCM is not required by DORA, continual monitoring is though and CCM provides an operational advantage that turns compliance into a business strength.
Your next step: get the starter pack
DORA compliance is a journey—but it starts with clarity. A gap analysis gives you the visibility to prioritise, remediate, and demonstrate progress.
To make it simple, we’ve created a white paper and 10-step checklist to help you kickstart your journey. It’s designed to take you from assessment to action, ensuring you don’t miss a critical requirement.
👉 Download the white paper and get your 10-step DORA checklist today. Download it now.
