DORA compliance check for IAM
Audit-ready
under DORA
Twelve questions, answered in a few minutes. At the end you see your maturity level and which evidence is missing for the audit.
No form. Your answers are not stored.
Twelve questions on your IAM
0of 12 answeredEach field is one requirement.
Audit day
Four questions as auditors ask them about IAM, one per maturity level. Choose the answer your organization would give today and see what the audit report would say. All examples are fictitious.
Then see what the auditor makes of it.
-
Scope
Where the check applies
The check refers to Commission Delegated Regulation (EU) 2024/1774, the regulatory technical standard on ICT risk management under DORA. Articles 20 and 21 apply to financial entities under the standard framework. Small and non-interconnected investment firms and a few other groups fall under the simplified framework in Title III, where Article 33 is the access control provision. As of October 2026. The check is not legal advice.
-
Scope limits
What the check excludes
The check maps requirements for identities and access. Other parts of the DORA RTS, such as incident reporting or risks from ICT third-party providers, are not covered. Authentication under Article 21(f) and physical access control under point (g) are not covered either. For AI agents in high-risk systems, obligations under the EU AI Act apply as well, see the white paper on agent identity.
FAQ
Common questions
Can't find your question?
Talk to our experts.
Which institutions does the check apply to?
Where do the four maturity levels come from?
Does the check replace an audit?
Do AI agents need their own account?
Do BAIT and VAIT still apply?
Ready for the next step
Match against your IAM
Thank you for your inquiry.
Your message has been sent successfully. Our team will get back to you shortly.