Of everything DORA requires, the DORA register of information is the deliverable supervisors actually collect – a structured inventory of every contractual arrangement for ICT services, submitted on request. This pack builds the whole framework around it. 107 editable Word and Excel files across ten sections, downloadable the moment you check out. On this page:
- What is in the toolkit
- DORA has applied since January 2025, so the question is evidence not readiness
- Who needs DORA register of information
- How the documents map to the framework
- Frequently asked questions
- Related toolkits
What is in the DORA register of information pack
The ten sections follow the five pillars of the Regulation plus the working tools that make them operable:
- 01 Programme Foundation and Governance – the management body accountability that DORA places personally on directors, the ICT governance framework and the programme charter
- 02 ICT Risk Management – the ICT risk management framework, asset and dependency mapping, risk assessment methodology and the protection and prevention measures
- 03 Incident Management and Reporting – classification criteria against DORA materiality thresholds, the initial, intermediate and final report templates, and the reporting timelines
- 04 Resilience Testing and TLPT – the testing programme, scope and scenarios, plus threat-led penetration testing material for entities that fall in scope of it
- 05 ICT Third-Party Risk – the pre-contractual assessment, contractual requirements, concentration risk analysis, exit strategies and the critical third-party provider position
- 06 Information and Intelligence Sharing – the arrangements DORA encourages for cyber threat intelligence exchange
- 07 Registers, Logs and Working Tools – the DORA register of information itself, plus the incident log, testing log and dependency registers
- 08 Audit, Assurance and Management Review – internal audit programme, assurance mapping and the management review pack
- 09 Regulatory Mapping and Traceability – article-by-article traceability so you can show a supervisor where each obligation is met
- 10 Awareness and Training – the ICT risk awareness programme including the board-level content DORA expects
DORA has applied since January 2025, so the question is evidence not readiness
Regulation (EU) 2022/2554 has applied since 17 January 2025. The implementation phase is over; supervisory expectations are now being tested in practice across banking, insurance, investment firms, payment institutions and crypto-asset service providers.
The DORA register of information is where that begins. Competent authorities collect it to identify critical ICT third-party providers across the market, which means it is not an internal document you can keep roughly accurate. It requires consistent identifiers, function mapping and criticality assessment across every ICT contract you hold.
The second area under real scrutiny is incident classification. DORA sets materiality thresholds that determine whether an incident is reportable and on what timeline, and getting that judgement wrong in either direction is visible to your supervisor. The classification criteria and report templates here are built to those thresholds rather than to a generic incident process.
Who needs DORA register of information
Financial entities in scope across the EU – credit institutions, payment and e-money institutions, investment firms, insurers and intermediaries, crypto-asset service providers, fund managers and more. ICT third-party providers whose financial-sector clients now push DORA contractual requirements down to them. And group functions that have to evidence one consistent framework across several regulated entities.
How the DORA register of information maps to the framework
DORA is a regulation rather than a standard, so there is no certificate at the end – only supervisory scrutiny. That makes traceability the organising principle: section 09 maps each article to the document that satisfies it, from the DORA register of information through to the training records, which is what turns a folder of policies into something you can walk a supervisor through.
Frequently asked questions
What exactly is the register of information?
A structured inventory of all contractual arrangements for ICT services, including provider identifiers, the functions supported and criticality assessments. Competent authorities collect it to map critical third-party providers across the market.
Does every entity have to do threat-led penetration testing?
No. TLPT applies to entities identified by their competent authority on significance criteria. The material is included for those in scope, and the broader testing programme applies to everyone.
How does this relate to NIS2?
They overlap but DORA takes precedence for financial entities as the more specific regime. Many groups run both. See the NIS2 Toolkit if non-financial entities in your group are in scope.
We hold ISO 27001. Does that cover DORA?
It covers a good deal of the ICT risk management pillar but nothing of the register of information, the incident reporting thresholds or the third-party contractual requirements. Those are DORA-specific.
How many documents are included?
107 editable files – 82 Word documents and 25 Excel workbooks – plus guidance and a licence file.
Related toolkits
Financial entities usually face several regimes at once. See the NIS2 Toolkit for non-financial group entities, the MiCA Toolkit for crypto-asset service providers whose DORA obligations run alongside it, the ISO 27001 Toolkit for the underlying ISMS and the ISO 22301 Toolkit for business continuity. Financial entities also need the third-party risk toolkit for the full vendor lifecycle, and the EU AMLR toolkit for the 2027 anti-money-laundering regime.
Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.
Delivery, format and licence
Your DORA register of information downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is watermarked or locked, so you can rebrand the documents, bring them under your own document control and revise them for as long as you need them.
One-time purchase. No subscription and no annual renewal. Because the source files are yours, revising a procedure after an audit finding or a change of scope is an internal edit rather than another purchase.
Reviews
There are no reviews yet