DORA covers a wide range of financial entities, and the depth of the requirements scales with size and risk profile. Smaller and less complex entities can apply a simplified ICT risk management framework. Larger entities face the full set of requirements, including advanced testing.
What this means in practice
A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.
Key actions
- Confirm which entity type you are under DORA
- Check whether the simplified framework applies
- Document how you applied proportionality
Next steps
Proportionality is not an exemption. It changes how much you do, not whether you do it. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.