Does DORA apply if we only use one cloud provider?

Yes. Concentration risk on a single provider is something DORA expects you to assess and document. Single-cloud is a legitimate choice - undocumented dependency is the problem.

Is DORA readiness the same as being certified?

No. There is no DORA certificate. Readiness means your framework, evidence and contracts would stand up to supervisory review.

DORA Readiness Checklist Tool

Self-assessment only. There is no DORA certificate; readiness means your framework and evidence would stand up to supervisory review.

Pillar 1: ICT risk management

Current inventory of ICT assets and cloud accounts, with owners.
Documented identification of critical functions and supporting systems.
Access management evidence: SSO, least privilege, joiner-mover-leaver, no shared long-lived credentials.
Backup and restore policy with tested restore evidence - not just backup job logs.
Business continuity and disaster recovery plan with defined RTO/RPO for critical functions.

Pillar 2: Incident management & reporting

ICT incident classification criteria documented and aligned with regulatory thresholds.
On-call runbook defines who decides severity and when compliance notification clocks start.
Monitoring and alerting coverage documented for production-critical cloud services.
Tabletop exercise completed with decision log retained.

Pillar 3: Resilience testing

Documented digital operational resilience testing programme with scheduled cadence.
Vulnerability assessments run on a defined schedule.
Scenario-based, failover or chaos exercises with stored evidence.
Restore tests producing evidence beyond backup job logs.

Pillar 4: Third-party risk & register

Register of all ICT third-party providers touching production.
Criticality mapping links providers to critical business functions.
Article 30 contract gap analysis for providers supporting critical functions.
Hyperscaler financial-services contract addenda signed and filed where applicable.

Your progress

0/17 · 0%

Early stage - start with asset and provider inventory, then incident classification and contract gaps.

Book Quick Assessment Read the DORA article DORA readiness service

DORA readiness checklist

Pillar 1: ICT risk management

Pillar 2: Incident management & reporting

Pillar 3: Resilience testing

Pillar 4: Third-party risk & register