Glossary · DORA
RTS and ITS
Regulatory and Implementing Technical Standards — the detailed EU rules that specify how DORA's high-level requirements work in practice.
Explained in depth: DORA overview
DORA is a framework regulation: many of its articles delegate the details to technical standards drafted by the ESAs and adopted by the European Commission. Regulatory technical standards (RTS) specify substantive requirements, such as the content of the ICT risk management framework, incident classification criteria, TLPT methodology, and required contract provisions for subcontracting. Implementing technical standards (ITS) specify formats and templates, such as the register of information and incident report forms. The standards are legally binding once adopted and published. In practice, DORA compliance work is done as much against the RTS/ITS texts as against the regulation itself, and the standards continued to be finalised and refined after DORA became applicable in January 2025.
Why it matters
Reading only the DORA regulation gives you the skeleton; the RTS and ITS are where the actual checklists live. Any gap analysis or audit that ignores them will miss most of the concrete requirements.