Which documents are required for DORA compliance?

Which documents are required for DORA compliance?

For DORA compliance, you need four document packages: governance and policies (including the ICT risk management framework, the resilience strategy and contingency plans), registers and inventories (register of information under Art. 28(3), ICT asset inventory), incident and testing records (reporting documentation, test plans, test reports) and contract and third-party documentation (third-party risk strategy, contracts under Art. 30, exit plans). The regulation does not require a separate “DORA manual”, but one has proven useful as an umbrella document for audits.

The importance of accountability under DORA

The principle that “if it isn’t documented, it didn’t happen” applies without exception to the implementation of Regulation (EU) 2022/2554 (DORA). The European Supervisory Authorities (EBA, ESMA, EIOPA) and national financial regulators such as BaFin require financial entities and critical ICT third-party service providers to provide clear, audit-proof evidence that digital resilience processes not only exist on paper but are actively practised and continuously reviewed.

Professional DORA document management protects management from liability risks under Article 5 and ensures that regulatory audits run smoothly. You can find out who is affected in our article on DORA scope and target groups.

Is a “DORA manual” mandatory?

A common question in audit and QM teams is: Is it mandatory to create a standalone document called a “DORA manual”?

DORA does not explicitly require a single, monolithic manual anywhere. However, Article 6(1) does require a sound, comprehensive and well-documented ICT risk management framework.

In practice, a DORA manual as a central umbrella document has become standard. It serves auditors as a navigation aid and provides a structured reference to existing sub-documents (e.g. ISMS documentation under ISO 27001, emergency manuals or contract registers).

The 4 pillars of DORA documentation

To ensure transparency and auditability, the required DORA documents can be divided into four core packages.

Package 1: Governance, strategies & policies

These fundamental documents form the organisational foundation. Under Article 5 DORA, the management body (board of directors or executive management) is responsible for them and approves them:

• ICT risk management framework (Art. 6 DORA): Central policy for identifying, assessing and managing all ICT risks.
• Digital operational resilience strategy (Art. 6(8)): Sets out how the framework is implemented, including risk tolerance, security objectives and key indicators.
• Information security policy (Art. 9): Requirements for encryption, identity & access management, password policies and network segmentation.
• ICT business continuity policy & disaster recovery plans (Art. 11 & 12): Emergency manuals to ensure continued operations, backup policies and plans to recover critical functions.
• Evidence of management body training (Art. 5(4)): Qualification records, attendance lists and training materials for the management body on ICT risks.

Package 2: Registers & asset inventory

Documents in this category must be updated continuously:

• Register of information (Art. 28(3)): Arguably the most complex DORA document. It records all contracts and arrangements for the use of ICT services, divided into services supporting critical or important functions and other services. Its structure follows the binding implementing technical standards (ITS) of the European Supervisory Authorities.
• ICT asset inventory (Art. 8(4) and (6)): Complete record of all hardware assets, software licences, network elements and interfaces (APIs).
• Overview of critical business functions (Art. 8(1)): Documentation of all ICT-supported business functions and their associated ICT systems and data flows.

Package 3: Incident management & resilience testing

These DORA records demonstrate the company’s ability to defend and respond:

• Incident management policy & classification matrix (Art. 17 & 18): Rules for detecting, handling and classifying ICT incidents as major or non-major.
• Reporting documentation for supervisory authorities (Art. 19): Reporting templates and deadline logs for initial notifications (within 4 hours of classifying an incident as major, and no later than 24 hours after becoming aware of it), intermediate reports and final root cause analyses for the supervisory authority.
• Testing programme & test reports (Art. 24 & 25): Digital operational resilience testing programme and reports on vulnerability scans and penetration tests.
• TLPT reports (threat-led penetration testing, Art. 26): For financial entities required to do so by the supervisory authority: reports on threat-led penetration tests (red teaming under TIBER-EU) including a remediation plan.

Package 4: Contract and third-party documentation

Given the strict requirements for using ICT service providers, contract documentation plays a key role. Our article on DORA for IT service providers shows what this means for the providers themselves.

• Strategy on ICT third-party risk (Art. 28(2)): Sets out how the company manages risks from ICT service providers, including a policy on services supporting critical or important functions.
• Pre-contractual due diligence reports (Art. 28(4)): Documented risk analyses before entering into a new supplier relationship.
• DORA-compliant ICT contracts (Art. 30): Revised service agreements with mandatory minimum clauses (e.g. audit rights, service level agreements (SLAs), termination rights, data processing locations).
• Exit strategies & exit plans (Art. 28(8)): Concrete instructions and migration concepts for switching or unwinding critical ICT services.

For an overview of all requirements of the regulation, see our article DORA: overview, requirements and implementation.

DORA documentation matrix at a glance

The following table gives quality managers and documentation owners an overview of the key documents, their legal basis and responsibilities:

Checklist: Is your DORA documentation complete?

Check the status of your compliance documentation with this checklist:

1. Umbrella documentation: Is there a central DORA manual or a structured reference matrix?
2. Risk framework and strategy: Are the ICT risk management framework and the resilience strategy up to date and approved by the board?
3. Contingency plans: Have the BCP/DRP plans been tested in practice in the past year and the results documented?
4. Register of information: Does your register follow the implementing technical standards (ITS) of the European Supervisory Authorities?
5. Contracts: Have contracts with ICT service providers been updated to meet the minimum requirements of Article 30 DORA?
6. Incident handling: Are templates for regulatory reporting with the deadlines (4 or at the latest 24 hours, 72 hours, 1 month) readily available?
7. Training records: Are the training records of all members of the management body complete?

Tips for efficient DORA document management

To keep the documentation effort from turning into bureaucratic chaos, these best practices help:

1. Avoid silos: Use existing documents from your ISO 27001 or TISAX audit. Map the DORA requirements instead of rewriting documents from scratch.
2. Ensure versioning and approvals: Every document needs clear revision levels, creation dates, management approvals and scheduled review dates.
3. Use software platforms: Maintaining registers of information and contract databases in manual Excel spreadsheets often leads to errors in audits. Specialised platforms offer ready-made workflows and automatic reminders.

Conclusion: Audit readiness through structured documentation

Clean and complete DORA documentation is the key to demonstrating compliance to financial supervisory authorities such as BaFin. By combining strategies and policies, continuously maintained registers and operational evidence, financial entities make sure their digital resilience can be fully demonstrated.

A structured approach – ideally supported by a central DORA manual and a digital compliance platform – significantly reduces the administrative burden and protects management from liability risks.

With heyData for fintech & finance, you implement DORA in a structured way: policies, the register of information and evidence are kept in one place, and what you document once also counts for ISO 27001, NIS2 and the GDPR.

Take the first step: Book a free demo now