Compliance & Regulation
GDPR Compliance Checklist: What Organizations Must Have in Place
GDPR is not new, but compliance gaps persist. A practical checklist of what controllers and processors must have in place — and be able to evidence.
Key takeaways
- DORA applies to a wide range of EU financial entities from 17 January 2025.
- It rests on five pillars: ICT risk management, incident reporting, resilience testing, third-party risk and information sharing.
- Critical ICT third-party providers come under direct EU oversight.
- Contracts with ICT providers must include specific provisions.
Scope
DORA (Regulation (EU) 2022/2554) applies to banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers and many other financial entities, with proportionality for smaller firms. It also creates an oversight framework for critical ICT third-party providers.
The five pillars
| Pillar | Key requirements |
|---|---|
| ICT risk management | Governance, framework, identification, protection, detection, response and recovery |
| Incident reporting | Classification of ICT-related incidents and reporting of major incidents to authorities |
| Resilience testing | Regular testing; threat-led penetration testing for selected entities |
| Third-party risk | Register of information, due diligence, contractual provisions, exit strategies |
| Information sharing | Voluntary sharing of cyber threat intelligence |
Management body accountability
The management body is ultimately responsible for ICT risk and must approve the framework, allocate budget and maintain sufficient knowledge.
Third-party requirements
Entities must maintain a register of ICT third-party arrangements, assess concentration risk and include mandatory contractual terms such as service descriptions, data location, audit rights, termination rights and exit support.
A practical roadmap
- Gap assessment against DORA and its technical standards.
- Update ICT risk framework and governance.
- Build incident classification and reporting procedures.
- Complete the register of information and update contracts.
- Establish the testing programme.
- Monitor, report and improve.
The register of information
Financial entities must maintain a register of all contractual arrangements with ICT third-party service providers, in a standardised format, and make it available to authorities. Building it usually exposes incomplete contract data, unknown subcontracting chains and concentration on a few providers — valuable insight in its own right.
Resilience testing programme
| Test type | Frequency guidance |
|---|---|
| Vulnerability assessments and scans | Regular, risk-based |
| Scenario-based and BCM tests | At least annually for critical functions |
| Penetration testing | Risk-based, including critical systems |
| Threat-led penetration testing | At least every three years for designated entities |
How NAZZTEC helps
We run DORA gap assessments, update ICT risk frameworks, build incident classification and reporting processes, compile registers of information and deliver resilience testing — managing evidence in NAZZTEC AI GRC.
Next step: see our Governance, Risk & Compliance services or NAZZTEC AI GRC.
Frequently asked questions
Does DORA apply to non-EU companies?
It applies to EU financial entities; non-EU ICT providers serving them will feel its effects through contracts and, if designated critical, through oversight.
How does DORA relate to NIS2?
DORA is the sector-specific law for financial entities and takes precedence where both would apply.
What is TLPT?
Threat-led penetration testing — an advanced, intelligence-based red team exercise required for selected entities.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
