DORA checklist for Norwegian financial firms

The cover image is an AI-generated editorial illustration. Screens and documents are illustrative concepts.

DORA concerns digital operational resilience in finance: ICT risk, incident handling, testing and third-party dependencies. A useful checklist connects those obligations to the services your firm delivers and the people accountable for them.

The Norwegian DORA law took effect on 1 July 2025. Scope needs a fresh check: from 1 September 2026, adapted DORA rules replaced the ICT Regulation for additional categories, including financing, debt-collection and real-estate firms, alongside Norsk naturskadepool. The adaptations matter; this is not a statement that every provision applies identically to all of them.

Establish the applicable obligations

1. Document scope. Identify the legal entity, regulated activity and relevant provisions. Check exclusions, the simplified framework and national adaptations separately. Small size alone does not establish eligibility for every exemption.
2. Assign governance. Record management-body responsibilities, operational owners and independent review. Give decision-makers the information and training needed to oversee ICT risk.
3. Map important functions. Connect business functions to applications, infrastructure, information and suppliers. Record dependencies that could prevent recovery.
4. Assess existing controls. Reuse evidence from an established management system where it genuinely meets the requirement. Keep the DORA-specific gaps visible.

Use Finanstilsynet’s DORA resources for current rules and reporting instructions.

Make response and supplier management workable

5. Prepare incident classification. Apply the relevant criteria with a named decision-maker and deputy. Keep a timeline and a route for updating the assessment as facts change.
6. Build the reporting process. Confirm triggers, deadlines, recipients and submission access. The reporting guide separates recurring records from incident notifications.
7. Maintain the ICT agreement register. Link contracts and providers to the functions they support. Validate identifiers and relationships before submission.
8. Review supplier terms and exits. Assess access, audit rights, incident assistance, subcontracting and exit arrangements against the applicable requirements. Assign responsibility for unresolved clauses.

Test and follow through

9. Plan resilience testing. Select methods against risk and coverage. General testing and designated threat-led penetration testing are different obligations; see the testing guide.
10. Track corrective action. Give findings owners, target dates and verification. Report material gaps and decisions to the appropriate management level.

The result should be a working programme with evidence, not ten checked boxes. The schedule depends on the gaps and operating constraints. FM’s DORA advisory service can support the assessment and implementation planning.