DORA Gap Assessment
A DORA gap assessmentis a structured review that measures a financial entity's current state against DORA's requirements across all five pillars, producing a prioritised list of gaps and remediation actions. It is usually the first engagement in a DORA programme.
What a gap assessment covers
A thorough assessment maps the entity's existing controls, policies, and contracts against each DORA obligation: ICT risk management, incident reporting, resilience testing, third-party risk, and information sharing. It identifies where documentation, governance, or testing falls short and rates each gap by risk and effort.
When you need one
Entities that have not yet mapped their programme to DORA, or that have changed materially since the January 2025 application date, benefit from a baseline. You can get an instant, self-service estimate with our free DORA Readiness Score before commissioning a formal assessment, then compare providers who deliver them.
What supervisors are actually checking
A gap assessment is only as useful as the bar it measures against, and that bar has moved. On 23 February 2026 the European Banking Authority published a follow-up to its 2022 peer review of how competent authorities assess ICT risk under the Supervisory Review and Evaluation Process (SREP). It found real progress since DORA's application date: authorities are applying DORA-driven ICT risk sub-categories more consistently, running horizontal analyses across firms rather than one-off reviews, and building dedicated ICT supervisory expertise. It also found that convergence across the EU is still uneven, so the depth of scrutiny an entity should expect still varies by home authority. A 2026 gap assessment should test against the evidence standards competent authorities now actually use, not just the bare text of the regulation.
Frequently asked questions
How long does a DORA gap assessment take?
Typically two to six weeks depending on entity size and the number of ICT third-party arrangements, though a self-service readiness check takes minutes.
Is a gap assessment mandatory under DORA?
No. DORA does not mandate a gap assessment, but it is the standard first step to demonstrate the entity understands and is closing its compliance gaps.
What is the difference between a gap assessment and a DORA audit?
A gap assessment identifies where you fall short and how to fix it; a DORA audit independently verifies compliance, usually after remediation.
Has ICT-risk supervision under DORA gotten stricter in 2026?
Yes. The EBA's February 2026 follow-up peer review found competent authorities applying more consistent, evidence-based ICT risk assessment methodologies under DORA, though it also found convergence across EU authorities is still uneven.