DORA is an operating-model regulation that got handed to IT. This assessment redistributes it: 62 requirements in plain language a COO can read, owned across the organization, with readiness percentages that compute from your honest statuses.
DORA reaches governance, incident reporting, resilience testing, and third-party contracts — most of which no IT function can implement alone. This workbook decomposes the regulation into requirements that route to their natural owners: the board obligations to the corporate secretary, the register of information to procurement, the testing program to resilience, the notification clocks to compliance. The worked example state deliberately spans COO, Legal, Procurement, Compliance, and Risk — because that's what a credible answer looks like.
ICT risk management (Art. 5–14), incident management & reporting (Art. 17–23), resilience testing (Art. 24–27), third-party risk incl. the register of information (Art. 28–30), and information sharing (Art. 45).
Not every requirement applies to every entity. Mark rows out of scope with a documented reason — they gray out and leave the math, defensibly.
Per-pillar readiness percentages (partial credit for partial implementation), the not-implemented list, and gap counts — computed, not asserted.
Every gap gets an owner, an action, a target date, and an overdue flag — the same remediation discipline as the rest of the PivotRisk line.
Citations at article level only — specific enough to navigate the regulation, stable enough not to rot as technical standards evolve.
The walkthrough, the readiness math documented, and every column defined.
The thinking: DORA Is Not an IT Problem and The Vendor Behind Your Vendor.
A single Microsoft Excel workbook (.xlsx). No macros; recalculates on open; also opens in Google Sheets and LibreOffice.
Neither. It's a structured, article-cited self-assessment that shows you where you stand and what to fix first. Scope determinations — especially proportionality and TLPT designation — belong with your compliance function and regulator.
Deliberately not below article level — sub-regulatory detail changes faster than any template should pretend to track. The workbook gets you organized at the level that endures; your compliance monitoring handles the moving parts.
Yes — internally or in client engagements. You can't resell the template itself as a template.
Five pillars, honest statuses, owned gaps — one workbook.