DORA Compliance Checklist:

How Sonatype helps you

DORA, an EU-wide requirement passed in 2024 and to
be enforced starting in January 2025, requires financial
entities to put measures in place to protect against
cybersecurity threats and disruptions to ICT services. Two
elements of DORA stand out: the ICT Risk Management
Framework and Regulation 56, which emphasises the
importance of open source analysis.

This guide can help you determine how prepared your
organisation is to comply with DORA’s key components.

DORA Compliance Checklist: Navigate New Cybersecurity Measures

ICT Risk Management

☐ Do we have processes to identify, monitor, and manage ICT risks?
☐ Are our ICT risk management policies and procedures up-to-date and aligned
with regulatory requirements?
☐ Do we have a process for continuous monitoring of ICT systems
and services?

Incident Reporting

☐ Do we have an incident reporting process in place for security-related incidents?
☐ Can we detect, manage, and report significant incidents within the required
timeframe?
☐ Have we conducted training and awareness programs for incident reporting?

Information Security

☐ Are our information security measures adequate to protect against ICT risks?
☐ Do we regularly review and update our information security policies?
☐ Are employees trained on information security protocols and practices?

Business Continuity and Disaster Recovery

☐ Do we have a robust business continuity and disaster recovery plan for
ICT disruptions?
☐ Are these plans tested regularly, and are staff trained on their roles in
these plans?
☐ Are backup systems and data recovery processes in place and
regularly tested?

Resilience Testing

☐ Have we implemented a testing program to assess our ICT systems' resilience?
☐ Do we conduct regular penetration testing, vulnerability assessments,
and other resilience tests?
☐ Are test results reviewed, and are necessary improvements
implemented promptly?

SBOM Creation and Maintenance

☐ Do we generate SBOMs for all software, including third-party
and open-source components?
☐ Are our SBOMs updated regularly to reflect any changes in
the software components?
☐ Are we identifying and documenting all software components,
including their versions, in our SBOMs?
☐ Do we have a process for verifying the authenticity and
integrity of each component listed in the SBOM?

How Sonatype Can Help

Monitoring the health and policy compliance of open
source components is essential to meeting these
DORA requirements. Sonatype is the industry’s
only comprehensive, proactive solution for end-to-end software supply chain security,
with more than 300 million open source components catalogued.
Sonatype also provides constant updates for third-party policies,
and an easy-to-use administrative UI
simplifies policy management.

DORA is just one part of the global trend of
cybersecurity requirements. To learn more about
how we can help you ensure compliance, check out
our DORA User's Guide to Compliance.