DORA compliance,
as a system.
In force since 17 January 2025 for banks, payment institutions, insurers, investment firms and their critical ICT providers. Three downloadable document systems — from your first gap assessment to a complete, audit-ready resilience programme. Aligned to the RTS/ITS, not just the main text.
"We're starting from zero and need to know where we stand."
→ Assessment & Response · gap assessment, risk framework, incident basics · $149 + VAT
"We need board-level policies and a third-party risk framework."
→ Risk & Governance · everything in A&R plus policies and procedures · $249 + VAT
"We want every DORA obligation covered, ready for the supervisor."
→ Complete System · all 19 documents, dashboards and audit packs · $999 + VAT
Assessment & Response System
$149 + VAT
"Everything you need to understand where you stand and manage your first incident."
4 documents · Excel + Word
View system →
Most popularRisk & Governance System
$249 + VAT
"The complete governance, risk, incident management and third-party framework."
7 documents · Excel + Word
View system →
Best valueComplete System
$999 + VAT
"The complete DORA operational resilience programme — every obligation covered."
19 documents · everything in R&G + 12 more
View system →
Every document is delivered as an editable Word or Excel file, cross-referenced to the DORA articles and RTS/ITS it covers.
| Document | A&R $149 + VAT |
Risk & Gov. $249 + VAT |
Complete $999 + VAT |
|---|---|---|---|
| DORA Compliance Gap Assessment | ✓ | ✓ | ✓ |
| DORA ICT Risk Assessment Framework | ✓ | ✓ | ✓ |
| DORA Incident Classification & Severity Framework | ✓ | ✓ | ✓ |
| DORA Incident Response Playbook | ✓ | ✓ | ✓ |
| DORA ICT Risk Management Policy | — | ✓ | ✓ |
| DORA Incident Management & Reporting Procedure | — | ✓ | ✓ |
| DORA Third-Party Risk Assessment | — | ✓ | ✓ |
| DORA Resilience Testing Plan | — | — | ✓ |
| DORA ICT Asset & Dependency Register | — | — | ✓ |
| DORA ICT Third-Party Risk Management Policy | — | — | ✓ |
| DORA TLPT & Resilience Testing Process | — | — | ✓ |
| DORA Regulatory Notification Pack | — | — | ✓ |
| DORA Compliance Monitoring Dashboard | — | — | ✓ |
| DORA ICT Performance & KPI Tracker | — | — | ✓ |
| DORA Incident Register & Tracker | — | — | ✓ |
| DORA Third-Party Risk Scoring Dashboard | — | — | ✓ |
| DORA Register of Information (RoI) Pack | — | — | ✓ |
| DORA Compliance Roadmap | — | — | ✓ |
| DORA Audit & Supervisory Readiness Pack | — | — | ✓ |
Are the documents aligned to the RTS and ITS, or just the DORA main text?
Aligned to the Level 2 technical standards — including RTS 2024/1772 (incident classification), RTS 2024/1774 (ICT risk management), the RTS on third-party risk and the ITS on the Register of Information. Most competing products stop at the main text.
Can I upgrade from a smaller system later?
Yes. Each system is a superset of the one below it — start with Assessment & Response, and contact us when you're ready to move up.
What exactly do I receive after payment?
A single .zip with all documents in editable Word and Excel formats, delivered by email within seconds. VAT invoice generated automatically by Gumroad.
How is VAT handled?
Displayed prices exclude VAT. Applicable VAT is calculated at checkout based on your location, and Gumroad (our merchant of record) collects and remits it. EU businesses with a valid VAT ID pay no VAT under the reverse-charge mechanism — simply enter your VAT ID at checkout.
Why are prices shown in USD?
Payments are processed by Gumroad, our global payment provider, which settles all transactions in US dollars. We show prices in USD so the amount you see is exactly the amount you are charged — no surprises at checkout. Your bank converts to your local currency automatically.
I'm a consultant — can I use one purchase across clients?
Each licence covers one entity. Consultants need one licence per client — or see the GRC Platform Consultant licences for multi-client workspace rights.
More questions? Read the full FAQ →
Not sure which to choose?
Start with Assessment & Response, upgrade anytime.
The Assessment & Response System is the right first step for most organisations. If you need more, the Complete System is always there.
Pair with GRC Platform
Documents tell you what to comply with.
The workspace proves you are doing it.
The GRC EU Platform is the operational layer — live databases for risks, controls, incidents, vendors and evidence. Works alongside these document systems.