What does the SuperClue DORA scan check?
The DORA scan runs 5 modules of external checks on your internet-facing services, mapped to the ICT risk management and testing duties of the EU Digital Operational Resilience Act. It checks transport security, exposed services, access control on public endpoints and the third-party providers your website loads. It is not an audit, and it does not replace threat-led penetration testing.
What is EU DORA?
| Fact | Detail |
|---|---|
| Law | Regulation (EU) 2022/2554 (DORA), applying since 17 January 2025 |
| Incident reporting | Major incidents: initial notification within 4 hours of classification and within 24 hours of awareness, intermediate report in 72 hours, final report within one month (RTS 2025/301) |
| Testing | Threat-led penetration testing at least every 3 years for identified entities (Article 26) |
| Third parties | Register of information on all ICT third-party arrangements (Article 28(3)) |
Who does EU DORA apply to?
- EU financial entities: credit, payment and e-money institutions, investment firms, insurers and others listed in Article 2.
- Critical ICT third-party providers designated by the European Supervisory Authorities.
What does the EU DORA scan check?
The scan runs 5 modules against the URL you give it. Each module maps what it can see from outside to one area of the framework.
| Module | What it looks at from outside |
|---|---|
| ICT Protection (Transport Security) | TLS version, certificate and transport headers. |
| Exposed Services and Files | Exposed configuration files, admin paths and status endpoints. |
| Access Control | Finds login and API endpoints and checks cookie flags. |
| Vulnerability Testing Input | Security headers, error handling and information disclosure. |
| Third-Party Providers Seen on the Site | Lists third-party script providers and flags scripts without integrity checks. |
What can the scan not see?
Incident reporting, threat-led penetration testing, contracts with ICT providers, the full register of information and governance are internal. The scan notes what evidence you need for these.
A passed check means the public signal is in place, not that the control works. Modules that need internal records can finish as "requires access". The scan is not an audit or a certification, and SuperClue is not a regulator or auditor.
What are the penalties?
| Failure | Maximum penalty | Source |
|---|---|---|
| Financial entities breaching DORA | Set by each member state, which must provide administrative penalties and remedial measures | DORA Article 50 |
| Critical ICT third-party providers not complying with the Lead Overseer | Periodic penalty of up to 1% of average daily worldwide turnover, imposed daily for up to six months | DORA Article 35(8) |
What does it cost?
The default rate is 0.30 credits per module, so all 5 modules come to 1.5 credits. See pricing or compare all 14 framework scans.
Run the 5 EU DORA checks on a domain you have verified.
Request access