The clock is ticking. With only 90 days until January 2026, financial institutions across the EU must prove they can survive, respond to, and recover from ICT disruptions—or face regulatory consequences. DORA isn’t a “future requirement”—it’s here, and auditors will expect evidence, not promises.
If your organisation isn’t fully aligned, the next three months will be make-or-break. Every system, control, and third-party relationship could be under scrutiny. Miss a step, and it’s not just fines on the line, it’s your operational resilience, your reputation, and your customers’ trust.
Understanding the 90-Day Imperative for DORA
DORA’s requirements span five pillars: ICT risk management, incident reporting, digital operational resilience testing, information sharing, and third-party risk management. Each area demands clear, demonstrable evidence that controls are in place, monitored continuously, and effective across your organisation’s digital landscape.
The urgency isn’t just regulatory. Operational resilience protects your business, your customers, and your reputation. Any gaps left unaddressed in the next 90 days could lead to fines, increased scrutiny, and even operational disruptions.
The key thing to note though; is it is still unclear how regulators will be auditing you for DORA – so let’s just say it’s best to dot the I’s and cross the T’s!!
Key Areas of Concern: Where Auditors Will Focus
While all DORA pillars matter, auditors are likely to pay extra attention to high-risk areas—especially given the rise in third-party cyber incidents:
- Third-Party Risk Management
Your organisation is only as strong as its weakest link. Recent cyber-attacks show that breaches often start with vendors. DORA requires not just knowing your vendors but actively monitoring their operational resilience. This includes visibility into your vendors’ controls, incident handling, and even their suppliers. Continuous monitoring tools are essential; manual checks alone won’t pass audit scrutiny. - ICT Systems and Controls
Auditors will expect evidence that critical systems are controlled and continuously monitored. Any gaps or lapses in monitoring are red flags. - Incident Response and Reporting
Detection and timely reporting of ICT-related incidents are under intense scrutiny. Auditors will want documented proof that your response plans are tested and effective.
Bottom line: Third-party risk and continuous monitoring are likely to be the make-or-break factors in passing a DORA audit. Focus here first to maximise your readiness in the final 90 days.
Where to Focus in the Final Countdown
- ICT Risk Management
Ensure every critical ICT system has a mapped risk profile. Identify high-risk areas, implement controls, and validate them continuously. Evidence of ongoing monitoring and testing will be required at audit. - Incident Reporting and Response
Review your incident management processes: Are incidents detected early? Are response and escalation procedures clear? Documented and tested processes are key to passing regulatory review. - Resilience Testing
Operational resilience isn’t theoretical—it’s practical. Regulators will expect evidence of resilience testing, including simulations of severe disruptions. Even if you’ve tested before, ensure your latest exercises cover critical digital systems and align with DORA expectations. - Third-Party Oversight
Reinforce monitoring of vendors and their suppliers. Use continuous controls monitoring to ensure that third-party risks are visible in real time, and weaknesses can be addressed before they become incidents. - Information Sharing and Reporting
Document and share operational resilience insights across your organisation. Ensure dashboards, reporting mechanisms, and internal communications reflect the true state of ICT controls.
Practical Steps for the Next 90 Days
- Conduct a gap analysis: Identify where your organisation falls short across all DORA pillars.
- Prioritise remediation: Focus on high-risk areas—particularly third-party monitoring and critical ICT systems.
- Implement continuous monitoring: Automated tools provide evidence that controls work continuously, not just at a point in time.
- Test and validate: Run tabletop exercises or simulations to ensure response plans work under pressure.
- Document everything: From risk assessments to incident logs, auditors will want clear, accessible evidence.
Why Time Matters for DORA Compliance
Three months may seem like plenty, but operational resilience improvements take time to implement, test, and embed. Organisations that start late risk rushing critical steps, leaving controls untested or documentation incomplete. With DORA audits looming, there’s no room for delay and you are going to need to prove you are continuously monitoring.
The 90-Day DORA Countdown: Audit-Readiness Roadmap
Phase 1: November – Assess & Prioritise
Goal: Understand gaps, prioritise high-risk areas, and plan remediation.
Weeks 1–2: Gap Analysis
- Map all critical ICT systems and their risk profiles.
- Identify gaps across all DORA pillars: ICT risk management, incident reporting, resilience testing, information sharing, third-party oversight.
- Review existing third-party contracts and controls – are they sufficient and auditable?
Weeks 3–4: Prioritisation & Planning
- Prioritise remediation based on risk and audit impact. High-risk = critical ICT systems and third-party controls.
- Develop a remediation plan: assign responsibilities, deadlines, and resources.
- Identify continuous monitoring tools needed for real-time assurance.
- Begin documentation of current processes, incidents, and controls for auditors.
Phase 2: December – Implement & Test
Goal: Remediate gaps, deploy monitoring, and test operational resilience.
Weeks 5–6: Control Remediation & Monitoring Implementation
- Implement missing controls in high-risk ICT systems.
- Onboard continuous controls monitoring (CCM) tools for critical systems and vendors.
- Strengthen third-party oversight: request control evidence from vendors, monitor suppliers where possible.
- Document all updates: changes, controls implemented, and risk mitigation steps.
Weeks 7–8: Resilience Testing & Incident Management
- Conduct tabletop exercises and simulations for critical disruptions.
- Review incident reporting procedures: ensure timely detection, escalation, and documentation.
- Update dashboards and reporting mechanisms to reflect real-time monitoring and test results.
- Share operational resilience insights with key stakeholders.
Phase 3: January – Validate & Certify Readiness
Goal: Ensure everything is audit-ready and continuously monitored.
Weeks 9–10: Audit Simulation & Validation
- Run internal audits/mock inspections to simulate regulator scrutiny.
- Validate continuous monitoring dashboards, logs, and evidence packages.
- Remediate any gaps discovered during simulations.
Weeks 11–12: Final Review & Continuous Assurance
- Confirm all documentation is complete and accessible: risk assessments, incident logs, third-party evidence, resilience testing results.
- Review communication channels: ensure management, auditors, and teams have a clear view of operational resilience.
- Set ongoing monitoring and reporting cadence to maintain compliance beyond DORA go-live.
Key Focus Areas Throughout the 90 Days
- Third-Party Risk Management – visibility into vendors’ controls and their suppliers.
- ICT Systems & Controls – continuous monitoring and evidence of effectiveness.
- Incident Detection & Reporting – tested and documented response plans.
- Operational Resilience Testing – practical simulations, not just policies.
- Documentation & Reporting – dashboards, logs, and evidence ready for auditors.
Quick Wins for DORA Compliance
- Automate monitoring where possible → saves time and provides continuous audit evidence.
- Focus first on high-risk vendors and critical ICT systems.
- Keep all documentation structured and accessible → auditors love clarity.
- Run tabletop exercises early to identify gaps → don’t wait until January.
The Path to Audit-Readiness for DORA
The final 90 days should be viewed as a sprint, not a soft push. Success depends on a structured approach, clear prioritisation, and leveraging technology to provide continuous assurance. Organisations that act now will enter 2026 with confidence, knowing they can withstand ICT disruptions, manage vendor risks, and satisfy auditor scrutiny.
For teams still unsure of where to start or how to structure their approach, a clear, practical roadmap is invaluable. Our DORA white paper breaks down every step, providing actionable guidance to ensure your organisation is fully prepared for audit.
Don’t leave audit-readiness to chance—download the full DORA roadmap in our white paper and take the final steps to secure operational resilience before the countdown ends. Download it now.
