How to use this checklist
The following checklist covers key cybersecurity areas for financial institutions in 2026, including DORA, NIS2, PCI DSS v4.0 requirements and regulatory best practices. Rate each item as: implemented / partially implemented / missing / not applicable.
Recommendation: conduct this review with your IT, CISO, and compliance team quarterly.
ICT Risk Management (DORA Pillar 1)
- ICT asset inventory — all systems, applications, and data mapped
- ICT risk management framework approved by the board
- Regular risk assessment (minimum annually, after every incident)
- Board directly oversees and approves cybersecurity strategy
- Cybersecurity budget allocated and proportionate to risk
- Business Impact Analysis (BIA) for critical financial processes
- Business continuity plans (BCP) tested within the last 12 months
Identity and Access Management (IAM)
- Multi-factor authentication (MFA) on all critical systems
- MFA for e-banking (SCA compliant with PSD2)
- Privileged Access Management (PAM) with session recording and password rotation
- Unique ID for every user (no shared accounts)
- Least privilege principle implemented and enforced
- Automated onboarding/offboarding linked to HR
- Quarterly access certifications (access review)
- Segregation of duties (SoD) in transaction systems
- Password policy compliant with PCI DSS v4.0 and DORA
Network Security
- Network segmentation — zones: DMZ, internal, SWIFT/core banking, management
- Firewalls with current rules, rule review every 6 months
- TLS 1.2+ encryption on all connections transmitting sensitive data
- VPN with MFA for remote access
- DDoS protection — scrubbing, CDN, rate limiting
- East-west traffic monitoring (lateral movement detection)
- Regular network segmentation testing
Application and API Security
- Open Banking API security: OAuth 2.0, rate limiting, data validation
- API Gateway centrally managing API traffic
- Web Application Firewall (WAF) on e-banking
- Secure SDLC — security code review, SAST/DAST testing
- Regular penetration testing of web and mobile applications
- OWASP Top 10 and OWASP API Top 10 protection
Monitoring and Detection (SOC)
- SOC operating 24/7 (in-house or as a Service)
- SIEM collecting logs from 15+ sources minimum
- Financial sector-specific correlation rules (BEC, credential stuffing, fraud)
- Mean Time to Detect (MTTD) < 1 hour for critical incidents
- SOAR playbooks for scenarios: BEC, DDoS, ransomware, insider fraud
- Threat intelligence from industry feeds (FS-ISAC, CERT)
- Regular threat hunting exercises
Incident Reporting (DORA Pillar 2)
- ICT incident reporting procedure compliant with DORA (initial notification within 4 h of classifying the incident as major, no later than 24 h after becoming aware of it — RTS 2025/301; then 72h/30 days)
- Incident classification by impact on financial services
- Incident Response team with assigned roles
- Crisis communication plan (clients, regulators, media)
- Post-incident review after every major incident
- Incident registry with trend analysis
Resilience Testing (DORA Pillar 3)
- Annual cybersecurity testing plan
- Quarterly vulnerability scanning (internal and external)
- Annual penetration testing of networks, applications, and APIs
- Scenario testing: DDoS, ransomware, BEC, insider threat
- TLPT (Threat-Led Penetration Testing) every 3 years (for systemically important institutions)
- Failover testing to backup infrastructure
- Backup recovery testing (RTO/RPO verification)
ICT Third-Party Management (DORA Pillar 4)
- Central registry of all ICT providers
- Provider concentration risk assessment
- Security clauses in ICT vendor contracts
- Audit and penetration testing rights with providers
- Exit strategies for critical providers
- SLAs covering security and availability requirements
- Regular provider compliance reviews
Payment Card Data Protection (PCI DSS)
- PCI DSS scope defined and minimized (tokenization, segmentation)
- Card data encrypted at rest and in transit
- Quarterly ASV (Approved Scanning Vendor) scan
- Annual PCI DSS audit (QSA or SAQ)
- PAN masked in logs and interfaces (first 6 / last 4 digits)
- Card data retention limited to required minimum
Training and Awareness
- Cybersecurity awareness training for all employees (minimum annually)
- Dedicated training for treasury, compliance, IT
- Quarterly phishing simulations
- Board training on DORA responsibilities
- BEC recognition training for payment processing staff
Backup and Recovery
- 3-2-1 backup strategy (3 copies, 2 media, 1 offline)
- Offline/air-gapped backup protected from ransomware
- Regular recovery testing (minimum quarterly)
- RTO and RPO defined and tested for critical systems
- Backups encrypted and protected with access control
Next Steps
- Conduct self-assessment using this checklist
- Identify items rated as “missing” or “partially implemented”
- Prioritize by risk and regulatory requirements
- Order a security audit for professional assessment
- Develop an implementation roadmap with timelines and budget
Schedule a free consultation — we’ll help assess your cybersecurity posture and develop an action plan.
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Related topics
See also:
