Training, exams and certification
Training, exams and certification
ICT risk management, incident reporting, resilience testing, third-party risk and information sharing: seventy requirements built on the Regulation and its delegated and implementing acts, linked to ISO/IEC 27001:2022 controls and the business continuity clauses of ISO 22301:2019.
By Claudio Restaino ·
Governance and management body (Article 5), the ICT risk management framework including the simplified framework of Article 16, identification, protection, detection, response and recovery, backup and restoration, learning and communication, incident classification and reporting (4h/24h, 72h, one month), the testing programme and TLPT, the ICT third-party strategy, the register of information, contractual provisions and exit strategies, oversight of critical ICT third-party providers, and information-sharing arrangements.
Regulatory status: Snapshot of 31 October 2026, applicable since 17 January 2025. References include Delegated Regulations 2024/1772, 2024/1773, 2024/1774, 2025/301, 2025/532 and 2025/1190, Implementing Regulations 2024/2956 and 2025/302, the designation of 19 critical ICT third-party providers on 18 November 2025 and the ESAs operational instructions on incident reporting of September 2026.
Nothing is sent to our servers: the assessment runs entirely in the browser, and you can download a save file to resume later or share with colleagues. No account is needed.
Compliance, legal, IT security and risk functions, DPOs, CISOs, consultants and auditors who need a quick, structured picture of where an organisation stands before planning a compliance programme or a certification.
The assessment is part of the GoToCertify Compliance Self-Assessment Hub, which also offers free assessments for the EU AI Act, the GDPR, NIS2 and DORA.
Credit institutions, payment and e-money institutions, investment firms, insurers, fund managers, crypto-asset service providers and the other financial entities in Article 2, as well as ICT third-party providers that serve them.
Yes. The profile questions adapt the requirements for entities eligible for the simplified ICT risk management framework of Article 16 and for microenterprises.
Business continuity, backup and testing are central to DORA; ISO 22301 clause 8 provides the recognised structure for BIA, strategies, plans and exercises.
Free, no registration, PDF report included.
Start the DORA self-assessment
BITIL.COM is an ATO (Accredited Training Organization) and an AEO (Approved Examination Organization) of PeopleCert. PRINCE2® and PRINCE2 Agile® are registered trade marks of PeopleCert.
