Who does DORA apply to?

DORA, Regulation (EU) 2022/2554, has applied directly since 17 January 2025 to financial entities within the meaning of Article 2: credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, trading venues, insurance and reinsurance undertakings, insurance intermediaries above a certain size, occupational pension institutions, credit rating agencies and others. ICT third-party providers designated as critical are additionally supervised directly. The proportionality principle in Article 4 allows implementation according to size and risk profile.

What are the five pillars of DORA?

DORA is structured in five pillars: ICT risk management (Articles 5 to 16), handling and reporting of ICT-related incidents (Articles 17 to 23), digital operational resilience testing (Articles 24 to 27), management of ICT third-party risk (Articles 28 to 30) and information sharing. The regulatory technical standards (RTS) specify, among other things, how often vulnerability scans must take place. blacklens.io supports the first four pillars technically but replaces neither your ICT risk management nor your reporting processes.

How often must vulnerability scans take place under DORA?

The RTS on the ICT risk management framework require automated vulnerability scans at a frequency commensurate with the classification and risk profile of the ICT asset, and at least weekly for assets supporting critical or important functions. blacklens.io tracks the external attack surface continuously and documents every scan, which makes the evidence simple.

Does blacklens.io PTaaS replace the TLPT?

No. TLPT under Article 26 is a supervisor-designated procedure following TIBER-EU that selected financial entities perform at least every three years, with testers qualified under Article 27 and threat intelligence providers. It covers critical or important functions in live production systems. blacklens.io PTaaS supports the regular testing needs under Article 25 and provides preparation and follow-up for the TLPT. We say this clearly because confusing the two gets expensive in an audit.

Does DORA apply to our ICT service provider too?

Contractually yes: Article 30 requires certain contractual provisions with ICT third-party providers, including security requirements, audit rights and exit strategies. Only providers designated as critical are supervised directly. With the supplier watchlist you monitor whether a provider is affected by ransomware or data leaks.

How does blacklens.io support the register of information?

You keep the register under Article 28(3) in your GRC tool. blacklens.io provides input for it: the technology and vendor inventory, the supplier watchlist and the asset inventory as CSV, so that the technical view matches the contractual one.

What does DORA mean for smaller institutions and insurance intermediaries?

DORA provides in Article 16 a simplified ICT risk management framework for certain small and non-interconnected entities, and Article 4 requires proportionate implementation. Continuous scanning of the external attack surface and a documented finding lifecycle are a solid foundation even under the simplified framework.

Compliance

DORA: evidencing ICT risk management technically

DORA has applied to financial entities since 17 January 2025. blacklens.io underpins inventory, vulnerability scanning, third-party risk and testing; TLPT remains a separate procedure.

Start free trial Book a demo

DORA evidenceas PDF

Asset inventoryDORA Art. 8continuous

Vulnerability scansRTS (EU) 2024/1774 Art. 10weekly

Supplier watchlistDORA Art. 28about every 30 min

Pentest reportDORA Art. 24 and 25after each test

What DORA requires

Regulation (EU) 2022/2554 applies directly, without national transposition. Four of its five pillars concern technology directly.

Art. 5 to 16

ICT risk management

Identify, protect and monitor assets; scans at least weekly for critical or important functions.

Art. 17 to 23

Handle and report incidents

Detect and classify ICT-related incidents and report major ones to the competent authority.

Art. 24 to 27

Test resilience

An ongoing testing programme, plus TLPT at least every three years for selected entities.

Art. 28 to 30

ICT third-party risk

Monitor providers, keep the register of information, include mandatory contract terms.

Technical guidance, not legal advice. Which obligations apply to you is for your legal department, auditor or supervisory authority to confirm.

DORA requirements mapped to blacklens.io

The mapping follows the regulation and the RTS on the ICT risk management framework (Delegated Regulation (EU) 2024/1774).

Art. 8

Newly discovered assets+4 since yesterday

beispiel-gmbh.atRoot domain

vpn.beispiel-gmbh.atFortiGate SSL-VPN 7.0.12Critical

dev-old.beispiel-gmbh.atGitLab 15.2Shadow ITHigh

mail.beispiel-gmbh.atExchange Server 2019Medium

203.0.113.24OpenSSH 8.9NewInfo

Art. 9; RTS Art. 10

Fix firstsorted by risk

1CVE-2024-21762vpn.beispiel-gmbh.atKEV

2CVE-2024-21410mail.beispiel-gmbh.atKEV

3TLS 1.0 enabledshop.beispiel-gmbh.atMedium

Art. 10; Art. 17 to 19

Early warning47 min ago

CVE-2024-21762FortiOS SSL-VPNCritical

CVE published08:12
2 assets in your inventory affected09:00
Confirmed by PoC scan09:26
Alert sent to Microsoft Teams09:27

Art. 24 and 25

Penetration testmanually validated

Authentication can be bypassedportal.beispiel-gmbh.atVerified

Other users' records readable via APIapi.beispiel-gmbh.atRetest passed

No limit on login attemptsshop.beispiel-gmbh.atUnder review

Art. 28 to 30

Supplier watchlist12 suppliers

Logistik Partner GmbHListed on a ransomware leak site, 30 min agoCritical

Software Zulieferer AGSoftwareNo hits

Muster SteuerberatungTax advisoryNo hits

Visuals show sample data.

What implementation looks like

1
Map critical functions
Add domains, cloud accounts and network segments to the scope and mark them with tags.
2
Set the scan cadence
External continuously, cloud weekly, Sentry on schedule. Critical findings go to ICT risk management.
3
Monitor third parties
Import suppliers from the register of information as CSV and enable leak site matching.
4
Automate evidence
Reports monthly, pentest reports per cycle, query reports for supervisory questions.

TLPT: what blacklens.io does and does not do

Under Article 26, supervisors require TLPT from selected financial entities; it follows TIBER-EU and is carried out by testers qualified under Article 27. blacklens.io does not replace TLPT but supports before, between and after.

Preparation
External attack surface inventory and dark web signals feed into the threat analysis.
Between cycles
Scans and PTaaS support the regular testing programme under Article 25.
Follow-up
TLPT findings run through the same workflow up to retest.

Compromised identities3 new hits

m.hu•••@beispiel-gmbh.atStealer log, 2 h agoEmployee

Microsoft 365 session cookieStealer log, 5 h agoEmployee

k.wa•••@gmx.atCombolist, 3 days agoCustomer

Frequently asked questions

: DORA, Regulation (EU) 2022/2554, has applied directly since 17 January 2025 to financial entities within the meaning of Article 2: credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, trading venues, insurance and reinsurance undertakings, insurance intermediaries above a certain size, occupational pension institutions, credit rating agencies and others. ICT third-party providers designated as critical are additionally supervised directly. The proportionality principle in Article 4 allows implementation according to size and risk profile.
: DORA is structured in five pillars: ICT risk management (Articles 5 to 16), handling and reporting of ICT-related incidents (Articles 17 to 23), digital operational resilience testing (Articles 24 to 27), management of ICT third-party risk (Articles 28 to 30) and information sharing. The regulatory technical standards (RTS) specify, among other things, how often vulnerability scans must take place. blacklens.io supports the first four pillars technically but replaces neither your ICT risk management nor your reporting processes.
: The RTS on the ICT risk management framework require automated vulnerability scans at a frequency commensurate with the classification and risk profile of the ICT asset, and at least weekly for assets supporting critical or important functions. blacklens.io tracks the external attack surface continuously and documents every scan, which makes the evidence simple.
: No. TLPT under Article 26 is a supervisor-designated procedure following TIBER-EU that selected financial entities perform at least every three years, with testers qualified under Article 27 and threat intelligence providers. It covers critical or important functions in live production systems. blacklens.io PTaaS supports the regular testing needs under Article 25 and provides preparation and follow-up for the TLPT. We say this clearly because confusing the two gets expensive in an audit.
: Contractually yes: Article 30 requires certain contractual provisions with ICT third-party providers, including security requirements, audit rights and exit strategies. Only providers designated as critical are supervised directly. With the supplier watchlist you monitor whether a provider is affected by ransomware or data leaks.
: You keep the register under Article 28(3) in your GRC tool. blacklens.io provides input for it: the technology and vendor inventory, the supplier watchlist and the asset inventory as CSV, so that the technical view matches the contractual one.
: DORA provides in Article 16 a simplified ICT risk management framework for certain small and non-interconnected entities, and Article 4 requires proportionate implementation. Continuous scanning of the external attack surface and a documented finding lifecycle are a solid foundation even under the simplified framework.

Compliance & audit

Overview of NIS2, ISO 27001, TISAX, DORA and critical infrastructure.

Supply chain monitoring

Match ICT third parties against ransomware and the dark web.

Penetration Testing

PTaaS for the testing programme under Article 25.

ISO 27001

Evidence Annex A controls with the same data.

DORA evidence without spreadsheet upkeep

See in a demo how inventory, weekly scans and third-party monitoring are documented. Or start with your domains.

Book a demo Try free for 14 days

14 days free, all features
No credit card required
We walk you through your first findings