Obligation
ICT risk management
A documented, governed framework for identifying, protecting against, detecting, responding to and recovering from ICT risk.
DORA
DORA brings ICT risk management, incident reporting, resilience testing and third-party oversight into one operational-resilience regime for financial entities and their critical providers.
- Regulation (EU) 2022/2554 · applies from 17 January 2025
- 3 related frameworks
- 4 Wombat pillars
- Last reviewed 31 Oct 2026
Why this matters now.
DORA is less about a one-off audit and more about proving that the organisation can withstand, respond to and recover from ICT disruption. Wombat connects the architecture baseline to the operational and third-party evidence that regulators ask for.
What the regulation asks for.
A practical reading of the obligations that usually end up in architecture, operations and evidence reviews.
Obligation
Incident management and reporting
Classification, early warning, notification and final reporting within defined timelines, with evidence of the response.
Obligation
Digital operational resilience testing
Regular testing of critical systems and recovery capability, proportionate to the entity's risk profile.
Obligation
ICT third-party risk
Contractual, concentration, exit and oversight requirements for critical ICT providers — including the ability to leave.
Where Wombat helps.
Each obligation maps to one or more pillars. The pillar pages show the controls, principles and evidence expectations behind the score.
WAF-OPS
Operational Excellence
DORA is an operating-model regulation: runbooks, change control, monitoring and evidence are the centre of gravity.
Read the Operational Excellence pillar →WAF-REL
Reliability
Recovery objectives, backup, failover and continuity testing are directly relevant to resilience testing.
Read the Reliability pillar →WAF-SEC
Security
Access control, vulnerability handling and secure configuration underpin the ICT risk framework.
Read the Security pillar →WAF-SOV
Sovereign
Third-party concentration, jurisdiction and exit strategy are part of the provider oversight story.
Read the Sovereign pillar →Control themes to review.
These are the control themes teams usually need to evidence. The controls catalogue is the authoritative source for the exact control-level mapping.
ICT risk management and governance
Incident classification and reporting
Resilience and recovery testing
ICT third-party and concentration risk
Business continuity and backup
Access control and cryptography
STEP 1
Score the operational-resilience baseline across operations, reliability and security.
STEP 2
Review third-party, exit and concentration controls before the next provider renewal.
STEP 3
Use failed controls to define resilience tests and recovery acceptance criteria.
STEP 4
Export evidence for the ICT risk register and management reporting.
Related frameworks and evidence.
Wombat controls carry tags for the frameworks below. Use them to connect the technical baseline to the evidence your auditor or procurement team already expects.
ISO 27001:2022
SOC 2 Type II
BSI C5:2020
Make resilience evidence repeatable
Run the scorecard, then put the same checks into CI so the evidence stays current between audits.
Wombat is a technical framework, not a law firm. These pages map relevant Wombat pillars and control themes to regulatory obligations; they do not provide legal advice. Validate the mapping against the official text and your auditor.
Related compliance hubs.
The same control baseline usually has to satisfy more than one obligation. Jump to the adjacent hub and reuse the evidence.
EU cybersecurity directive
NIS2
NIS2 raises the baseline for cybersecurity risk management, incident reporting and supply-chain accountability across essential and important entities in the EU.
Open the NIS2 hub →German cloud compliance catalogue
BSI C5
The BSI Cloud Computing Compliance Criteria Catalogue (C5) is the German benchmark for cloud security, transparency and auditability — and a common procurement requirement for cloud providers and their customers.
Open the BSI C5 hub →Cloud sovereignty criteria
BSI C3A
C3A is the BSI's non-binding criteria catalogue for digital sovereignty in cloud services. It is structured around six sovereignty categories: strategic, legal and jurisdictional, data, operational, supply chain and technology.
Open the BSI C3A hub →Control, not just location
Sovereignty
Residency, jurisdiction, key ownership, supplier concentration and exit paths — turned into controls a team can assess.
Open the sovereignty hub →