DORA compliance,
as a system.
In force since 17 January 2025 for banks, payment institutions, insurers, investment firms and their critical ICT providers. One complete, downloadable document system — from your first gap assessment to audit-ready supervisory evidence. Aligned to the RTS/ITS, not just the main text.
DORA Complete System
$799 + VAT
"The complete DORA operational resilience programme — every obligation covered."
19 documents · Excel + Word
View system →
Save $199DORA + NIS2 Complete Bundle
$1,299 + VAT
"For organisations carrying both regimes — both complete systems in one purchase."
36 documents · incl. Country Pack · Excel + Word
View bundle →
Every document is delivered as an editable Word or Excel file, cross-referenced to the DORA articles and RTS/ITS it covers.
| DORA Compliance Gap Assessment | ✓ |
| DORA ICT Risk Assessment Framework | ✓ |
| DORA Incident Classification & Severity Framework | ✓ |
| DORA Incident Response Playbook | ✓ |
| DORA ICT Risk Management Policy | ✓ |
| DORA Incident Management & Reporting Procedure | ✓ |
| DORA Third-Party Risk Assessment | ✓ |
| DORA Resilience Testing Plan | ✓ |
| DORA ICT Asset & Dependency Register | ✓ |
| DORA ICT Third-Party Risk Management Policy | ✓ |
| DORA TLPT & Resilience Testing Process | ✓ |
| DORA Regulatory Notification Pack | ✓ |
| DORA Compliance Monitoring Dashboard | ✓ |
| DORA ICT Performance & KPI Tracker | ✓ |
| DORA Incident Register & Tracker | ✓ |
| DORA Third-Party Risk Scoring Dashboard | ✓ |
| DORA Register of Information (RoI) Pack | ✓ |
| DORA Compliance Roadmap | ✓ |
| DORA Audit & Supervisory Readiness Pack | ✓ |
Are the documents aligned to the RTS and ITS, or just the DORA main text?
Aligned to the Level 2 technical standards — including RTS 2024/1772 (incident classification), RTS 2024/1774 (ICT risk management), the RTS on third-party risk and the ITS on the Register of Information. Most competing products stop at the main text.
Is there a smaller or cheaper version?
No. DORA is sold as one complete system, so you never pay twice for documents you already own. If you also fall under NIS2, the DORA + NIS2 bundle saves $199 against buying both separately.
What exactly do I receive after payment?
A single .zip with all documents in editable Word and Excel formats, delivered by email within seconds. Tax invoice generated automatically by Gumroad.
How is VAT handled?
Displayed prices exclude VAT. Applicable VAT is calculated at checkout based on your location, and Gumroad (our merchant of record) collects and remits it. EU businesses with a valid VAT ID pay no VAT under the reverse-charge mechanism — simply enter your VAT ID at checkout.
Why are prices shown in USD?
Payments are processed by Gumroad, our global payment provider, which settles all transactions in US dollars. We show prices in USD so the amount you see is exactly the amount you are charged — no surprises at checkout. Your bank converts to your local currency automatically.
I'm a consultant — can I use one purchase across clients?
Each licence covers one entity. Consultants need one licence per client — or see the GRC Platform Consultant licences for multi-client workspace rights.
More questions? Read the full FAQ →
One system, one price
Every DORA obligation, one purchase.
19 editable documents aligned to the RTS and ITS — from gap assessment to supervisory readiness. Updates included for 12 months.
Pair with the EU Compliance Workspace
Your DORA documents, operated in Notion.
The documents define what you must do. The workspace is where your team records that it is being done, and where an auditor can see it. You enter what the documents specify — there is no automated import.
| In the document system | In the workspace | What it becomes |
|---|---|---|
| Compliance Gap Assessment | Compliance Requirements | Each gap becomes a requirement record. Requirements with no linked control surface in the Gaps Only view. |
| ICT Risk Assessment Framework | Risk Register | Assessed ICT risks, scored likelihood × impact and linked to the controls that mitigate them. |
| Incident Classification · Authority Reporting Procedure | Incident Register | Every incident logged against the 4-hour, 72-hour and one-month reporting fields. |
| Register of Information · Third-Party Risk Assessment | Vendor Risk Register | ICT providers tracked one by one, with their Article 30 contractual status. |