Lion Cipher Lab
Does DORA apply to you? Scope it, score the five pillars, and build a Register of Information
- GRC / Compliance
- Intermediate
- ~75 min
- Free · no account required
Why it matters
DORA is the law that decided the European financial sector had spent twenty years worrying about whether banks held enough capital and almost no time worrying about whether their technology would still be standing on a bad Tuesday. It is live: it has applied since 17 January 2025, so this is not a deadline to prepare for, it is a regime firms are being supervised against right now. And its reach is wider than people expect — not just banks, but insurers and insurance intermediaries, investment firms, payment and electronic-money institutions, crypto-asset service providers, trading venues,…
What you'll learn
- DORA applicability: the Article 2 financial-entity test
- proportionality and the Article 16 simplified ICT risk management framework
- the five DORA pillars and a self-scored maturity assessment
- building a Register of Information (contractual arrangements table)
- judging whether a function is critical or important, and defending the call
- reading a regulation vs a directive, and what lex specialis means in practice
- Level 1 vs Level 2 (RTS/ITS) — where the real requirements actually live
- mapping DORA onto an existing ISO 27001 / NIS2 control set instead of starting over
Steps in this lab
- What DORA is — and why REGULATION is the most important word in the sentence
- Lex specialis, Level 1 and Level 2 — the two things that stop you reading DORA wrong
- Set up your worksheet and pick a fictional financial firm
- Applicability part 1 — are you a FINANCIAL ENTITY under Article 2?
- Applicability part 2 — proportionality and the Article 16 simplified framework
- The five pillars — map them, then score yourself against each
- Pillar two in detail — classify the incident, then run the three-report clock
- Pillar three in detail — everyone tests, and some do TLPT
- Build the Register of Information — the deliverable that actually hurts
- The judgment call — is this function CRITICAL OR IMPORTANT? Now defend it
- Pillar four's other half — the ESAs' oversight of critical ICT third-party providers
- Do it better — extend the programme you already have, and do not over-engineer
- Write the one-page verdict and the dated fix list