The eleven expected deliverables

The list, in production order

Why this order

Deliverable 4 — the mapping — appears early and conditions five others. An organisation that starts with the register of information without having identified its critical functions fills the "function supported" field by guesswork, and will have to redo it all.

The duplication trap

Many organisations already hold an ISO/IEC 27001 ISMS, an ISO 22301 BCMS or arrangements aligned with the EBA guidelines. The reflex is to write brand-new DORA documents alongside the existing ones.

That is an expensive and detectable error: the supervisor finds two backup policies that diverge, two risk registers, two testing programmes. The right approach is to enrich the existing documents and produce a mapping note stating, article by article, where the DORA requirement is met.

What the supervisor looks at first

In the order observed: the board resolution approving the framework (Article 5), the register of information (Article 28), the year's test reports (Article 25), and the record of the last major incident notification (Article 19).

All four are dated, signed documents. None can be improvised the day before a review.