DORA Compliance Checklist: 10 Steps for Financial Entities

What a DORA checklist is?

A DORA compliance checklist is a practical way to turn a complex regulation into a set of concrete tasks. DORA, the Digital Operational Resilience Act, sets detailed requirements for how financial entities manage technology risk, and a checklist breaks those requirements down into steps a team can plan, assign and track.

The most useful checklists do more than restate the law. They connect each obligation to the technical capability that makes it real, so that a requirement like operational resilience becomes a concrete decision about redundant connectivity, and a requirement like fast incident reporting becomes a decision about monitoring and detection. This is what turns a checklist from a summary into an actionable plan.

The checklist on this page is technical rather than legal. It focuses on the network, security and resilience building blocks that underpin DORA, and shows where Teldat, as a European infrastructure manufacturer, supports each one. It does not replace legal advice or a full compliance program, but it helps ensure the technical foundations are sound.

Checklist mapped to the five pillars

DORA is organized into five pillars, and every item on a good checklist traces back to one of them. The table shows how the ten steps that follow map onto the pillars, so nothing essential is missed.

The x10 step DORA checklist

These are the ten technical steps that underpin DORA compliance. Each step names the pillar it serves and the capability that delivers it, so the list works as an actionable plan rather than a summary.

Incident reporting deadlines

Incident reporting is the most time critical part of any DORA checklist, so it deserves its own view. The table sets out the three stages and the clock for each, all of which depend on detecting the incident fast in the first place.

How Teldat supports each step?

Teldat is not a compliance consultancy; it is a European manufacturer whose infrastructure maps directly onto the technical steps of the checklist. The table shows which Teldat capability supports which step, so the link between the checklist and the technology is explicit.

Common compliance gaps

Even entities that take DORA seriously tend to stumble on the same points. Knowing where the common gaps are helps a checklist catch them before an auditor does.

FAQ’s about the DORA checklist

❯ What is a DORA compliance checklist?

A DORA compliance checklist is a structured list of the steps a financial entity needs to take to align with the Digital Operational Resilience Act. It translates DORA’s five pillars, ICT risk management, incident reporting, resilience testing, ICT third party risk and information sharing, into concrete, actionable tasks. A good checklist links each requirement to the technical capability that supports it, such as resilient connectivity, layered security, monitoring and detection, so that compliance teams can see not only what DORA demands but how to meet it in practice. This page provides a 10 step technical checklist and shows how Teldat’s European infrastructure supports each step.

❯ Who needs to follow a DORA checklist?

Any financial entity in the scope of DORA benefits from a compliance checklist. That includes more than 22,000 entities across the EU, from banks, insurers and investment firms to payment institutions, electronic money institutions and crypto asset service providers, as well as their critical ICT third party providers. Larger entities follow the full framework, while microenterprises and certain smaller firms use a simplified ICT risk management framework under Article 16. A checklist helps all of them structure the work, but the technical fundamentals of resilient connectivity, strong security, monitoring and third party oversight apply across the board.

❯ What are the incident reporting deadlines in a DORA checklist?

Incident reporting is one of the most time sensitive items on any DORA checklist. For a major ICT related incident, DORA requires an initial notification to the competent authority within 4 hours of the incident being classified as major, an intermediate report within 72 hours, and a final report within one month. The 4 hour initial deadline is the tightest in EU regulation, which is why the checklist places so much weight on detection and monitoring: you can only report within 4 hours if you can detect and classify that fast, which is where extended detection and response such as Teldat be.Safe XDR contributes.

❯ How does Teldat support a DORA compliance checklist?

Teldat is a European infrastructure manufacturer whose portfolio maps directly onto the technical steps of a DORA checklist. Teldat SD-WAN provides the resilient, self healing connectivity behind operational resilience; be.Safe Pro delivers cloud security with Secure Web Gateway and Next Generation Firewall functions; and be.Safe XDR provides the monitoring and extended detection and response needed to meet DORA’s incident reporting clocks. Operating as a European manufacturer under European jurisdiction, Teldat also helps address the ICT third party and concentration risk pillar. Teldat does not certify compliance, but its sovereign infrastructure supports the technical steps the checklist covers.

❯ Is a DORA checklist enough to be compliant?

A checklist is a valuable tool for structuring the work, but it is not a substitute for a full compliance program or legal advice. DORA is a detailed regulation with obligations that depend on an entity’s size, risk profile and activities, and compliance ultimately rests with the entity and is assessed by competent authorities. A technical checklist like this one helps ensure the key building blocks, from resilient connectivity to incident reporting and third party oversight, are in place, but entities should combine it with governance, documentation and, where needed, specialist legal and audit support.