Skip to content
Free Tool

Multi-Framework Compliance Mapping

See how DORA maps to ISO 27001, NIS2, GDPR, and COBIT. If you already comply with one framework, instantly see which DORA requirements you already cover.

25
DORA requirements mapped
66%
ISO 27001 overlap
73%
NIS2 overlap
3
DORA-unique requirements

Select Frameworks

Coverage Calculator

Select frameworks your organization already complies with to see DORA coverage:

Select frameworks above to see the coverage calculation

1 ICT Risk Management

DORA Article Requirement ISO 27001NIS2
Art. 5ICT risk management framework and governance ✓ Full ✓ Full
Art. 6(1)Identification and classification of ICT systems, protocols and tools ✓ Full ◐ Partial
Art. 6(8)Regular review and audit of ICT risk management framework ✓ Full ◐ Partial
Art. 7ICT systems, protocols and tools must be kept up to date and secure ✓ Full ◐ Partial
Art. 8ICT business impact analysis and risk assessment ✓ Full ✓ Full
Art. 9Protection and prevention measures for ICT systems ✓ Full ✓ Full
Art. 10ICT incident detection and discovery ✓ Full ✓ Full
Art. 11ICT business continuity policy and plans ✓ Full ✓ Full
Art. 12Backup and restoration policies for ICT services ✓ Full ✓ Full

2 Incident Management

DORA Article Requirement ISO 27001NIS2
Art. 17ICT incident management process ✓ Full ✓ Full
Art. 18Classification of ICT incidents ◐ Partial ✓ Full
Art. 19Reporting major ICT incidents to competent authorities ◐ Partial ✓ Full
Art. 20Content and templates for incident reporting ✗ None ✓ Full
Art. 13Learning and evolving from ICT incidents ✓ Full ◐ Partial
Art. 14Communication about ICT incidents ◐ Partial ✓ Full

3 Resilience Testing

DORA Article Requirement ISO 27001NIS2
Art. 24General requirements for digital operational resilience testing ◐ Partial ◐ Partial
Art. 25Testing of ICT tools and systems ◐ Partial ◐ Partial
Art. 26Advanced threat-led penetration testing (TLPT) ✗ None ✗ None
Art. 27Requirements for TLPT testers ✗ None — N/A

4 Third-Party Risk

DORA Article Requirement ISO 27001NIS2
Art. 28General principles for managing ICT third-party risk ✓ Full ✓ Full
Art. 29Contractual arrangements for ICT services ◐ Partial ◐ Partial
Art. 30Critical contractual provisions for ICT services ◐ Partial ✗ None
Art. 31Oversight framework for critical ICT third-party service providers ✗ None ✗ None

5 Information Sharing

DORA Article Requirement ISO 27001NIS2
Art. 45Cyber threat intelligence sharing arrangements ◐ Partial ✓ Full
Art. 45(2)Information exchange through trusted communities ◐ Partial ✓ Full

Legend

Full matchPartial matchNo matchN/A

Start Your DORA Compliance Assessment

Now that you know your gaps, run a full DORA assessment and get a personalized action plan.

Start Assessment