Skip to main content
DORA Auditor

DORA blog

Practical guides, regulatory news, and analysis for compliance teams working through DORA. Sourced and dated, like everything else on this site.

20 articles

guideLatest

DORA Article 11: Business Continuity and Disaster Recovery

DORA Article 11 requires a business impact analysis, RTO/RPO targets, and annually tested continuity and disaster recovery plans. Updated October 2026.

Read guide
guideSeptember 28, 2026

DORA Critical or Important Function: How to Classify It

How to classify a critical or important function under DORA, and what changes once you do: contracts, exit strategy, notification. Updated September 2026.

newsSeptember 27, 2026

ESAs Flag Non-EU ICT Reliance and AI-Driven Cyber Risk

The ESAs' Autumn 2026 risk update (23 September 2026) warns on non-EU ICT provider dependency and AI-accelerated cyber risk, pointing back to DORA's third-party risk and ICT risk management rules.

regulationSeptember 21, 2026

DORA Incident Reporting and the EU Digital Omnibus

The EU Digital Omnibus proposes routing DORA incident reports through one ENISA portal shared with NIS2 and CER. Updated September 2026.

guideSeptember 14, 2026

DORA for Insurers: EIOPA's 2026 Supervisory Priorities

EIOPA's 2026 work programme puts insurers' ICT registers, incident classification, and third-party governance under scrutiny. Updated September 2026.

guideSeptember 7, 2026

DORA Resilience Testing Requirements: Articles 24-25

DORA Articles 24-25 require a testing programme from vulnerability scans to penetration tests, annually for critical ICT systems. Updated September 2026.

guideAugust 31, 2026

DORA ICT Risk Management Framework: What to Document

DORA Article 6 requires eight documented policies, from asset identification to crisis communication, not one combined risk policy. Updated August 2026.