DORA: Compliance Manual for Financial Entities
From the five pillars to the ICT Register and TLPT: complete operational guide
DORA & Financial
DORA: Compliance Manual for Financial Entities
Regulation (EU) 2022/2554 (DORA) has applied directly across the EU since 17 January 2025 and governs how financial entities must manage ICT risk, classify and notify incidents, test their resilience (including TLPT) and manage their technology providers. This manual translates DORA's five pillars into a step-by-step implementation plan, with an exhaustive checklist per pillar and a reusable ICT provider factsheet template.
Contents / Contenido
- 1. Executive summaryPreview
- 2. Context: what DORA is and why it existsPreview
- 3. Scope: who must complyPreview
- 4. The five pillars of DORARequires download
- 5. Pillar 1 — ICT risk managementRequires download
- 6. Pillar 2 — Incident management, classification and notificationRequires download
- 7. Pillar 3 — Digital operational resilience testing and TLPTRequires download
- 8. Pillar 4 — ICT third-party risk management and the Register of InformationRequires download
- 9. Pillar 5 — Information sharing on cyber threatsRequires download
- 10. Regulatory timelineRequires download
- 11. Step-by-step implementation planRequires download
- 12. DORA compliance checklistRequires download
- 13. Reusable template: ICT provider criticality matrix and factsheetRequires download
- 14. Common implementation mistakesRequires download
- 15. GlossaryRequires download
- 16. How Hodeitek helpsRequires download
- 17. SourcesRequires download
Preview: first pages
Regulation (EU) 2022/2554 (DORA) has applied directly across the EU since 17 January 2025 and governs how financial entities must manage ICT risk, classify and notify incidents, test their resilience (including TLPT) and manage their technology providers. This manual translates DORA's five pillars into a step-by-step implementation plan, with an exhaustive checklist per pillar and a reusable ICT provider factsheet template.
The preview of this whitepaper includes the executive summary, regulatory context and methodological approach that frames the rest of the document. Download to access full templates, matrices and checklists.
- 1. Executive summary
- 2. Context: what DORA is and why it exists
- 3. Scope: who must comply
Gorka Gonzalo
Founder & CEO
Founded Hodeitek in 2023 and runs the company, after more than 8 years in pentesting, Red Team, OT/ICS auditing, and SOC leadership. A cybersecurity and AI expert, he sets the technical and product direction of HodeiShield and personally leads the most critical engagements — from defense strategy to applying AI in threat detection. He is the client's direct point of contact: whoever scopes the work also answers for the result.
“This whitepaper is the clearest guide I've seen on NIS2 in 2026.”
Related resources
NIS2 Supply Chain Guide: From Art. 21 to the Provider Register
Article 21.2.d of NIS2 requires essential and important entities to manage the security of their direct suppliers and service providers as part of their risk management policy. This guide explains what the article actually requires, how it relates to the ENS and DORA, and proposes a phased implementation plan with checklists and a reusable supplier assessment questionnaire template.
How to Choose a TPRM Platform: Criteria for 2026
NIS2, DORA and the ENS all agree that provider risk cannot be outsourced away by subcontracting the service, which turns third-party risk management (TPRM) into a mandatory compliance function. This document explains what each framework requires on third parties, the five criteria blocks that separate a functional TPRM platform from the rest, and provides a reusable evaluation matrix for RFP/RFI processes.