Skip to content

Skills tagged DORA

14 skills relate to DORA. The tag says which framework a skill relates to; the skills contain no text from it.

Backup restore test evidenceUse this skill when a restore test is due, an auditor or customer asks for proof that backups can be recovered, or someone says "plan a restore test", "prove we can recover in time", "our backups…EvidenceISO 27001, SOC 2, DORA, HIPAATristan Roth
Business impact analysisUse this skill when a company needs recovery objectives it can defend, before a continuity plan, a disaster recovery design, an audit or a resilience review, and asks "do a BIA", "business impact…Incidents and continuityISO 27001, DORA, NIS 2, GeneralTristan Roth
Continuity tabletop designUse this skill when a company must test its incident response or continuity plan without breaking anything, because an audit, a customer, a regulator or the plan itself calls for an exercise, and…Incidents and continuityISO 27001, SOC 2, DORA, NIS 2Tristan Roth
Evidence request list builderUse this skill when an auditor, assessor or regulator has sent a request list and the team asks "turn the auditor's request list into tasks", "who needs to provide what", "build the evidence…EvidenceISO 27001, SOC 2, NIS 2, DORATristan Roth
GRC setup reviewUse this skill when someone wants to know where to start with the grcskills library, or asks "review my GRC setup", "what should I fix before the audit", "which compliance skills do I need", "audit…Gap and readinessGeneral, ISO 27001, SOC 2, GDPR, NIS 2, DORA, ISO 42001, EU AI ActTristan Roth
ICT risk framework checkUse this skill when a bank, payment or e-money institution, investment firm, insurer, crypto-asset service provider or other financial entity in scope of DORA needs to know whether its ICT risk…RiskDORATristan Roth
ICT third-party registerUse this skill when a financial entity in scope of DORA needs to build or refresh its register of ICT third-party arrangements, and someone asks "build our register of information", "list our ICT…Vendors and third partiesDORATristan Roth
Incident severity triageUse this skill when something is happening now: an alert, a suspicious login, a ransomware note, data sent to the wrong customer, an outage that might be an attack, and someone asks "how bad is…Incidents and continuityGeneral, ISO 27001, SOC 2, NIS 2, DORATristan Roth
Internal audit checklist from scopeUse this skill when an internal auditor has one process or area to audit and needs a working checklist built from the company's own documents, or asks "build an internal audit checklist", "audit…Audit prep and responseISO 27001, ISO 42001, GDPR, NIS 2, DORATristan Roth
Regulatory incident reporting clockUse this skill when an incident may have to be reported to an authority, customers or affected people, and the team asks "do we have to notify", "72 hours", "24 hour early warning", "is this a…Incidents and continuityNIS 2, DORA, GDPR, HIPAATristan Roth
Risk acceptance memoUse this skill when a risk owner wants to accept a residual risk instead of treating it further, or when someone asks "write a risk acceptance", "we want to accept this risk", "risk exception form"…RiskGeneral, ISO 27001, DORATristan Roth
Risk method draftingUse this skill when a company needs a written risk assessment method before it builds or rescores a register, or when the current method produces registers where everything scores 3. Triggers: "write…RiskISO 27001, ISO 27701, ISO 42001, DORA, GeneralTristan Roth
Risk register first passUse this skill when a team needs its first information security risk register, or has one that is a copied catalogue nobody owns, and asks "build our risk register", "draft a risk assessment", "what…RiskISO 27001, SOC 2, NIS 2, DORA, GeneralTristan Roth
Vendor tieringUse this skill when a company needs to decide how much assessment each supplier deserves, or asks "tier our vendors", "which suppliers are critical", "we have 200 vendors and cannot assess them all"…Vendors and third partiesGeneral, ISO 27001, SOC 2, DORA, NIS 2Tristan Roth