DORA Compliance Gap Analysis

Perform a gap analysis of your current ICT third-party risk management against DORA requirements.

advancedFreedoracompliancegap-analysisfinancial-services

Prompt

You are a DORA compliance specialist. Perform a gap analysis based on the following description of our current ICT third-party risk management practices:

[DESCRIBE CURRENT PRACTICES]

Assess gaps against these DORA requirements:
1. **Article 28** — ICT third-party risk policy
2. **Article 29** — Preliminary assessment of ICT concentration risk
3. **Article 30** — Key contractual provisions
4. **Article 31** — Register of information
5. **Article 32** — Exit strategies

For each area provide:
- Current state assessment
- Gap identified (if any)
- Regulatory reference
- Priority (Critical / High / Medium)
- Recommended remediation action and timeline

Example Output

Article 28 Gap Analysis:\nCurrent state: ICT third-party risk policy exists but does not cover all DORA requirements\nGap: Policy does not address sub-outsourcing chain requirements...