DORA Compliance Assessment Tool

Welcome to the DORA Compliance Assessment Tool. Please answer the following questions to evaluate your organization's compliance with the DORA EU resilience act regulation.

First Name:

Surname:

Email:

Job Title:

Organization Name:

Organization Description:

How many people in your organization?

Less than 10 Less than 50 Less than 250 Less than 750 Less than 1500 Less than 5000 Less than 10000 Over 10000

Number of countries you operate in, within the EU:

...

Number of countries you operate in, outside the EU:

...

Does your organization provide financial products or services?

Yes No

Are you an ICT Services provider to financial organizations?

Yes No

What is your annual revenue?

What is your total balance sheet value?

Where is your organization based?

Where do you deliver services?

Where is your data held?

How would you rate your organization's security risk management? (1-10)

...

What rating would you give your organization for knowledge of threat? (1-10)

...

When was the last live continuity test your organization performed?

When was your organization's last Penetration Test?

Do you have any of the following Certifications or Accreditations, select all that apply?

When was the last time your organisation reviewed security risk?

When was the last time your organisation reviewed threat?

Planned in next 12 months Now/last 6 months 12 Months ago 24 Months ago More than 3 years ago Never

When was the last time your organisation reviewed continuity and resilience?

Planned in next 12 months Now/last 6 months 12 Months ago 24 Months ago More than 3 years ago Never

Estimated total number of IP addresses in your organisation:

Estimated number of IP Addresses that are public:

What is the organisations risk appetite?:

Whats your appetite?

Rating: ...

Resilience and Continuity:

How resilient are you?

Rating: ...

Risk of Legacy Software:

Legacy systems in production include...

Rating: ...

Your Security Maturity:

Are you firefighting or improving?

Rating: ...

Average Time to Patch Critical Vulnerabilities:

How exposed are you?

Rating: ...

Incident Response:

Do you know who to call?

Rating: ...

User awareness and testing:

The human firewall...

Rating: ...

Vulnerability Management:

How are the doors and locks?

Rating: ...

Threat Intelligence and Information Sharing:

How connected is your organisation

Rating: ...

Which of these areas concern you?

Are you planning to gain or maintain any of the following Certifications or Accreditations to support your DORA compliance, select any that may apply.

Who/What do you view as your threat actors?

What would you view your threat actors motive to be, select all.

Which of the following ways do you manage ICT third-party providers?

We don't Relationship New supplier form Supplier risk assessment Supplier Certification requirement Annual supplier review Supplier register Supplier audit policy

What level of dependency do you have on third-party ICT providers,choose all that apply.

None Minor systems, local only Minor systems, organisation wide General business systems, local General business systems, organisation wide Critical supply, local only Critical supply, organisation wide Entirely dependant

What do you rate your organisational threat level as?

Rating: ...

What do you rate your industry threat level as?

Rating: ...

Maturity of physical controls securing information technology:

Rating: ...