Free DORA gap analysis tool
Check which DORA requirements you already meet and where the gaps are. You answer the questions area by area (about 15 minutes) and get your result instantly: an overall maturity percentage and a score for every area. Open the full report with recommendations, DORA articles and the top 10 priorities for free with one click, no e-mail needed.
How to rate the requirements (scale 1 to 5)
The questions cover the responsibility of the management body, ICT risk management, ICT-related incidents, digital operational resilience testing, ICT third-party risk and information sharing on cyber threats, plus an optional section for ICT service providers. For each requirement choose the level that best describes the situation today, not the plan for next quarter. If you have no evidence (a document, a record, a report), choose the lower level.
- 1None: the activity is neither performed nor planned.
- 2Planned: there is a decision or plan, but implementation has not started.
- 3In progress: implementation is under way, it works partially and documentation is incomplete.
- 4Implemented: it works and is documented, people are trained, but there is no systematic measurement yet.
- 5Optimized: it works, is measured, reviewed and improved in a regular cycle.
- n/aNot applicable: only for selected questions; the requirement does not apply (justify this in your documentation). It does not affect the score.
Your answers are stored only in your browser; you can stop and come back later. The result appears after the last area, or earlier once you have answered at least 60% of the questions.
Frequently asked questions
What is a DORA gap analysis?
A comparison of your current practices with the requirements of Regulation (EU) 2022/2554 (DORA) and its RTS/ITS: the ICT risk management framework (Art. 5 to 16), ICT incident management and reporting (Art. 17 to 23), digital operational resilience testing (Art. 24 to 27) and ICT third-party risk (Art. 28 to 30).
Who should complete it?
Financial entities in scope of DORA, such as banks, insurers, payment institutions, investment firms and fund managers. An ICT service provider to the financial sector can use it to prepare for due diligence questionnaires and the Art. 30 contract annex.
What about entities under the simplified framework (Art. 16)?
Entities covered by Art. 16 DORA apply a simplified ICT risk management framework and are not subject to advanced threat-led penetration testing (TLPT). Choose "Not applicable" for questions that do not apply to you; such answers do not lower the score.
Since when does DORA apply?
The regulation entered into force on 16 January 2023 and has applied directly in all EU member states since 17 January 2025. In Poland DORA is supervised by the Polish Financial Supervision Authority (KNF).
Is the result a conformity assessment for the supervisor?
No. It is a self-assessment for information purposes. It shows where the biggest gaps are and where to start, but it does not replace the review of the ICT risk management framework or the internal audit required by DORA.
Related tools
This tool is for information and self-assessment only. It is not legal advice, an audit or a conformity assessment, and it does not replace an analysis by a specialist. The result depends on the accuracy of your answers. Need a second opinion? Talk to us.