https://fortifydata.com/assets/DoraReadiness-MzU3yjMG.js

1import{r as d,a as M,X as L,u as B,j as e,P as H,L as v,O as R,S as z,D as Q,B as b,Y as $,C as F,I as U,t as h,w as Y}from"./index-BMiUqZ7n.js";import{C as G}from"./checkbox-CUO1uVtC.js";import{R as W}from"./refresh-cw-ByRLgpOH.js";const y=[{value:"addressed",label:"Addressed"},{value:"partial",label:"Partially addressed"},{value:"not_addressed",label:"Not addressed"},{value:"unsure",label:"Unsure"}],C=[{title:"DORA third-party risk management",url:"/resources/dora-third-party-risk-management"},{title:"DORA vendor risk assessment",url:"/resources/dora-vendor-risk-assessment"},{title:"DORA register of information",url:"/resources/dora-register-of-information"},{title:"DORA contract requirements",url:"/resources/dora-contract-requirements"},{title:"Critical or important functions",url:"/resources/dora-critical-or-important-functions"},{title:"Continuous vendor monitoring",url:"/resources/dora-continuous-vendor-monitoring"},{title:"ICT concentration risk",url:"/resources/dora-ict-concentration-risk"},{title:"DORA TPRM checklist",url:"/resources/dora-tprm-checklist"}],I={inventory:0,classification:4,critical_functions:4,due_diligence:1,vendor_assessment:1,contracts:3,evidence:7,monitoring:5,concentration:6,exit:0,incident:3,register:2,reassessment:5},X=[{id:"inventory",area:"ICT service inventory",question:"Do you maintain an inventory of ICT third-party services and their contractual arrangements?",action:"Reconcile procurement, finance and technology records; assign an owner and capture each ICT service arrangement, not just each vendor.",reference:"Article 28(3)",resourceIndex:0},{id:"classification",area:"Service classification",question:"Are ICT services classified consistently by risk and the functions they support?",action:"Document proportionate classification criteria and apply them at service and arrangement level.",reference:"Article 28(1), (4)",resourceIndex:0},{id:"critical_functions",area:"Critical or important functions",question:"Have you identified which ICT services support critical or important functions and documented the rationale?",action:"Map service dependencies to functions and record impact-based criticality decisions with accountable owners.",reference:"Article 28(4)(a)",resourceIndex:0},{id:"due_diligence",area:"Pre-contract due diligence",question:"Do you complete and document proportionate provider due diligence before contracting?",action:"Record provider suitability, supervisory conditions, conflicts and relevant service risks before approval.",reference:"Article 28(4)",resourceIndex:1},{id:"vendor_assessment",area:"Provider risk assessment",question:"Do assessments consider provider security, resilience, locations and relevant subcontracting risks?",action:"Assess service-specific security and continuity evidence, third-country risks and relevant subcontractor dependencies.",reference:"Articles 28(4)–(5), 29(2)",resourceIndex:0},{id:"contracts",area:"Contract provisions",question:"Have written ICT contracts been reviewed against baseline DORA provisions and enhanced provisions where critical or important functions are supported?",action:"Map clauses to Article 30(2); separately review Article 30(3) provisions for critical or important function support and agree remediation with legal owners.",reference:"Article 30(1)–(3)",resourceIndex:0},{id:"evidence",area:"Evidence and accountability",question:"Can accountable owners retrieve current evidence supporting third-party risk decisions and approvals?",action:"Create an evidence index linking assessments, approvals, contracts and review records to each arrangement, with owners and review dates.",reference:"Articles 5(2), 28(2), (4), (6)",resourceIndex:1},{id:"monitoring",area:"Ongoing monitoring",question:"Do you monitor service performance, security and material provider changes on a risk-based basis?",action:"Define service indicators, escalation thresholds and risk-based assurance or audit activities; track material changes and remediation.",reference:"Articles 28(6), 30(3)",resourceIndex:1},{id:"concentration",area:"Concentration risk",question:"Do you assess reliance on non-substitutable providers and multiple critical or important services from the same or connected providers?",action:"Map connected providers and substitutability; assess aggregate dependency and document risk treatment rather than assuming a single-provider ban.",reference:"Article 29(1)",resourceIndex:0},{id:"exit",area:"Exit planning",question:"For ICT services supporting critical or important functions, are exit strategies documented and exit plans sufficiently tested and periodically reviewed?",action:"Define feasible alternatives, transition periods, data return and continuity steps; test proportionately and record lessons and plan updates.",reference:"Articles 28(8), 30(3)(f)",resourceIndex:0},{id:"incident",area:"Incident coordination",question:"Are provider incident assistance and coordination responsibilities agreed and connected to your incident process?",action:"Agree notification and escalation contacts, assistance terms and evidence flows; align them with the entity's applicable incident reporting obligations.",reference:"Articles 17–19, 30(2)(f)",resourceIndex:0},{id:"register",area:"Register of information",question:"Do you maintain the register of all ICT service contractual arrangements using applicable templates and reporting instructions?",action:"Reconcile the register to all arrangements, distinguish critical or important support, and validate against current ITS, taxonomy and competent-authority instructions.",reference:"Article 28

1(3); Implementing Regulation 2024/2956",resourceIndex:2},{id:"reassessment",area:"Reassessment and governance",question:"Are provider risks and third-party policies reviewed regularly and when material changes occur, with management oversight?",action:"Set risk-based review schedules and event triggers, report findings to accountable management and track remediation; do not assume every provider requires annual reassessment.",reference:"Articles 5(2), 28(2), (6)",resourceIndex:1}],o=X.map(r=>({...r,resourceIndex:I[r.id]})),D="Educational self-assessment based on your answers across 13 ICT third-party risk areas. Addressed is self-reported, not independently verified. Partial, not addressed and unsure are reported separately; unsure means evidence or ownership needs confirmation. No weighting, numeric score, pass/fail threshold or compliance certification is applied.",q="This is a readiness discussion aid, not legal advice, an audit or confirmation of DORA compliance. Applicability and proportionate implementation depend on your entity and services. The financial entity remains responsible for its obligations. Consult current legal texts and competent-authority instructions.",O="2026-09-23";function J(r){if(!r||typeof r!="object"||Array.isArray(r)||Object.keys(r).length!==o.length||o.some(s=>!Object.hasOwn(r,s.id)||!y.some(a=>a.value===r[s.id])))throw new Error("Complete all 13 questions using the allowed answers; unknown question IDs are not accepted.");const i=o.map(s=>{const a=r[s.id],l=a==="addressed"?"Maintain and periodically verify: ":a==="partial"?"Complete the remaining work: ":a==="unsure"?"Confirm ownership and evidence first: ":"Establish this practice: ";return{...s,status:a,statusLabel:y.find(u=>u.value===a).label,nextAction:l+s.action,resource:C[I[s.id]]}});return{areas:i,addressedAreas:i.filter(s=>s.status==="addressed"),potentialGaps:i.filter(s=>s.status!=="addressed"),partialAreas:i.filter(s=>s.status==="partial"),notAddressedAreas:i.filter(s=>s.status==="not_addressed"),unknownAreas:i.filter(s=>s.status==="unsure"),actions:i.map(s=>({id:s.id,area:s.area,status:s.status,action:s.nextAction,resource:s.resource})),resources:C,methodology:D,disclaimer:q,sourceReviewDate:O}}function ee(){const[r,i]=d.useState({}

1),[s,a]=d.useState(0),[l,u]=d.useState(!1),[m,j]=d.useState(""),[f,w]=d.useState(!1),[N,_]=d.useState(""),{toast:k}=M(),p=L();B({title:"DORA Third-Party Risk Readiness Assessment",description:"Evaluate your TPRM program against DORA's ICT third-party risk requirements and get a customized action plan.",canonical:"https://fortifydata.com/resources/dora-readiness-assessment",jsonLd:[{"@context":"https://schema.org","@type":"WebApplication",name:"DORA TPRM Readiness Assessment",description:"Evaluate your third-party risk program against the Digital Operational Resilience Act requirements.",applicationCategory:"BusinessApplication"},{"@context":"https://schema.org","@type":"BreadcrumbList",itemListElement:[{"@type":"ListItem",position:1,name:"Home",item:"https://fortifydata.com/"},{"@type":"ListItem",position:2,name:"Resources",item:"https://fortifydata.com/resources"},{"@type":"ListItem",position:3,name:"DORA Hub",item:"https://fortifydata.com/resources/dora"},{"@type":"ListItem",position:4,name:"Readiness Assessment",item:"https://fortifydata.com/resources/dora-readiness-assessment"}]}]});const g=o[s];s>=o.length;const T=t=>{i(n=>({...n,[g.id]:t})),s<o.length-1?a(n=>n+1):(u(!0),h("engagement","dora_readiness_complete"))},S=()=>{s>0&&(a(t=>t-1),u(!1))},P=()=>{i({}),a(0),u(!1),j(""),w(!1),p.reset()},c=d.useMemo(()=>{if(!l)return null;try{return J(r)}catch{return null}},[l,r]),E=async t=>{if(t.preventDefault(),!(!m||!f))try{await p.mutateAsync({data:{email:m,answers:r,consent:!0,honeypot:N}}),h("form_submit","dora_readiness","team-notified"),h("conversion","dora_readiness"),k({title:"Results Sent",description:"Your readiness assessment results have been requested."})}catch(n){h("form_error","dora_readiness");let x="There was an error submitting your request. Please try again later.";n?.status===400?x="Please provide a valid business email address.":n?.status===429?x="Too many requests. Please try again in a few minutes.":n?.status===503?x="The email service is temporarily unavailable. Please try again later.":n?.body?.error&&(x=n.body.error),k({title:"Unable to send results",description:x,variant:"destructive"})}},A=Object.keys(r).length/o.length*100;return e.jsx(H,{children:e.jsxs("div",{className:"bg-background min-h-screen pb-24",children:[e.jsxs("div",{className:"bg-foreground text-white py-12 relative overflow-hidden",children:[e.jsx("div",{className:"absolute inset-0 opacity-10 [background-image:linear-gradient(rgba(255,255,255,.2)_1px,transparent_1px),linear-gradient(90deg,rgba(255,255,255,.2)_1px,transparent_1px)] [background-size:64px_64px]","aria-hidden":"true"}),e.jsxs("div",{className:"container relative mx-auto px-4 md:px-6 z-10",children:[e.jsxs(v,{href:"/resources/dora",className:"inline-flex items-center gap-2 text-sm font-semibold text-white/60 transition-colors hover:text-white mb-6",children:[e.jsx(R,{className:"h-4 w-4"}),"Back to DORA Hub"]}),e.jsx("h1",{className:"text-3xl md:text-5xl font-extrabold tracking-tight mb-4",children:"DORA TPRM Readiness Assessment"}),e.jsx("p",{className:"text-lg text-white/80 max-w-3xl",children:"Evaluate your third-party risk program against the Digital Operational Resilience Act requirements. Identify gaps and get a tailored action plan without marketing noise."})]})]}),e.jsx("div",{className:"container mx-auto px-4 md:px-6 mt-8",children:!l||!c?e.jsxs("div",{className:"max-w-3xl mx-auto",children:[e.jsxs("div",{className:"mb-8",children:[e.jsxs("div",{className:"flex justify-between text-sm font-bold text-muted-foreground mb-2",children:[e.jsxs("span",{children:["Question ",s+1," of ",o.length]}),e.jsxs("span",{children:[Math.round(A),"%"]})]}),e.jsx("div",{className:"h-2 w-full bg-muted rounded-full overflow-hidden",children:e.jsx("div",{className:"h-full bg-secondary transition-all duration-300 ease-out",style:{width:`${A}%`}})})]}),e.jsxs("div",{className:"bg-card border border-border shadow-xl rounded-2xl p-6 md:p-10 animate-in fade-in slide-in-from-bottom-4",children:[e.jsxs("div",{className:"mb-4 inline-flex items-center gap-2 rounded-full bg-secondary/10 px-3 py-1.5 text-xs font-bold tracking-wider up

1percase text-secondary",children:[e.jsx(z,{className:"h-4 w-4"})," ",g.area]}),e.jsx("h2",{className:"text-2xl md:text-3xl font-bold text-foreground leading-tight mb-8",children:g.question}),e.jsx("div",{className:"space-y-3",children:y.map(t=>e.jsxs("button",{onClick:()=>T(t.value),className:"w-full text-left p-4 md:p-5 rounded-xl border border-border bg-muted/30 hover:border-secondary/50 hover:bg-secondary/5 transition-all duration-200 group flex items-center justify-between",children:[e.jsx("span",{className:"font-semibold text-foreground group-hover:text-secondary",children:t.label}),e.jsx(Q,{className:"w-5 h-5 text-muted-foreground group-hover:text-secondary opacity-0 -translate-x-2 group-hover:opacity-100 group-hover:translate-x-0 transition-all"})]},t.value))}),e.jsxs("div",{className:"mt-8 pt-6 border-t border-border flex justify-between items-center",children:[e.jsxs(b,{variant:"ghost",onClick:S,disabled:s===0,className:"text-muted-foreground hover:text-foreground",children:[e.jsx(R,{className:"w-4 h-4 mr-2"})," Back"]}),e.jsxs("span",{className:"text-xs text-muted-foreground font-mono bg-muted px-2 py-1 rounded",children:["Ref: ",g.reference]})]})]})]}):e.jsxs("div",{className:"max-w-5xl mx-auto space-y-8 animate-in fade-in duration-700",children:[e.jsxs("div",{className:"flex items-center justify-between",children:[e.jsx("h2",{className:"text-3xl font-extrabold text-foreground",children:"Assessment Results"}),e.jsxs(b,{variant:"outline",onClick:P,size:"sm",className:"gap-2",children:[e.jsx(W,{className:"w-4 h-4"})," Retake Assessment"]})]}),e.jsxs("div",{className:"bg-muted/30 border border-border rounded-2xl p-6 md:p-8 flex flex-col md:flex-row gap-8 items-center justify-between",children:[e.jsxs("div",{className:"flex-1",children:[e.jsxs("h3",{className:"text-xl font-bold text-foreground mb-2 flex items-center gap-2",children:[e.jsx($,{className:"w-5 h-5 text-secondary"})," Save your results"]}),e.jsx("p",{className:"text-muted-foreground text-sm",children:"Enter your business email to receive a copy of your customized action plan and gap analysis."})]}),e.jsx("div",{className:"w-full md:w-[400px]",children:p.isSuccess?e.jsxs("div",{className:"bg-secondary/10 text-secondary p-4 rounded-lg flex items-center gap-3 font-semibold text-sm",children:[e.jsx(F,{className:"w-5 h-5 shrink-0"}),"Request accepted. You should receive an email shortly."]}):e.jsxs("form",{onSubmit:E,className:"space-y-4",onFocusCapture:()=>{m||h("form_start","dora_readiness")},children:[e.jsx("input",{type:"text",className:"hidden",tabIndex:-1,autoComplete:"off",value:N,onChange:t=>_(t.target.value)}),e.jsx("div",{className:"space-y-2",children:e.jsx(U,{type:"email",placeholder:"Business email address",required:!0,value:m,onChange:t=>j(t.target.value),className:"bg-card"})}),e.jsxs("div",{className:"flex items-start gap-2",children:[e.jsx(G,{id:"consent",checked:f,onCheckedChange:t=>w(t===!0)}),e.jsx("div",{className:"grid gap-1.5 leading-none",children:e.jsxs("label",{htmlFor:"consent",className:"text-xs text-muted-foreground font-medium leading-tight peer-disabled:cursor-not-allowed peer-disabled:opacity-70",children:["I consent to receive my results via email. See ",e.jsx(v,{href:"/privacy-policy",className:"underline hover:text-secondary",children:"Privacy Notice"}),"."]})})]}),e.jsx(b,{type:"submit",className:"w-full",disabled:!m||!f||p.isPending,children:p.isPending?"Sending...":"Email My Results"})]})})]}),e.jsxs("div",{className:"grid sm:grid-cols-3 gap-6",children:[e.jsxs("div",{className:"bg-card border border-border rounded-2xl p-6 shadow-sm",children:[e.jsxs("div",{className:"flex items-center gap-3 mb-2",children:[e.jsx("div",{className:"w-8 h-8 rounded-full bg-risk-green/10 flex items-center justify-center text-risk-green font-bold",children:c.addressedAreas.length}),e.jsx("h3",{className:"font-bold text-foreground",children:"Addressed"})]}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"Areas where your program aligns with DORA requirements."})]}),e.jsxs("div",{className:"bg-card border border-border rounded-2xl p-6 shadow-sm",children:[e.jsxs("div",{className:"flex items-center gap-3 mb-2",children:[e.jsx("div",{className:"w-8 h-8 rounded-full bg-risk-amber/10 flex items-center justify-center text-risk-amber font-bold",children:c.partialAreas.length}),e.jsx("h3",{className:"font-bold text-foreground",children:"Partial / Potential Gaps"})]}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"Areas needing improvement or documentation."})]}),e.jsxs("div",{className:"bg-card border border-border rounded-2xl p-6 shadow-sm",children:[e.jsxs("div",{className:"flex items-center gap-3 mb-2",children:[e.jsx("div",{className:"w-8 h-8 rounded-full bg-risk-red/10 flex items-center justify-center text-risk-red font-bold",children:c.notAddressedAreas.length+c.unknownAreas.length}),e.jsx("h3",{className:"font-bold text-foreground",children:"Not Addressed / Unsure"})]}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"Critical gaps requiring immediate attention."})]})]}),e.jsxs("div",{className:"bg-card border border-border rounded-2xl overflow-hidden shadow-sm",children:[e.jsx("div",{className:"bg-muted px-6 py-4 border-b border-border",children:e.jsx("h3",{className:"font-bold text-foreground text-lg",children:"Recommended Actions"})}),e.jsx("div",{className:"divide-y divide-border",children:c.actions.map((t,n)=>e.jsxs("div",{className:"p-6 md:p-8 flex flex-col md:flex-row gap-6 hover:bg-muted/30 transition-colors",children:[e.jsxs("div",{className:"shrink-0 w-32",children:[e.jsx("div",{className:"text-xs font-bold uppercase tracking-wider text-muted-foreground mb-1",children:t.area}),e.jsx("div",{className:`inline-flex px-2 py-1 rounded text-[10px] font-bold uppercase tracking-wider ${t.status==="not_addressed"||t.status==="unsure"?"bg-risk-red/10 text-risk-red":t.status==="partial"?"bg-risk-amber/10 text-risk-amber":"bg-risk-green/10 text-risk-green"}`,children:t.status.replace("_"," ")})]}),e.jsxs("div",{className:"flex-1",children:[e.jsx("p",{className:"text-foreground font-medium mb-3",children:t.action}),t.resource&&e.jsxs(v,{href:t.resource.url,className:"inline-flex items-center gap-1.5 text-sm font-bold text-secondary hover:underline",children:[e.jsx(Y,{className:"w-4 h-4"})," ",t.resource.title]})]})]},`${t.id}-${n}`))})]}),e.jsxs("div",{className:"bg-muted/50 rounded-xl p-6 text-sm text-muted-foreground leading-relaxed",children:[e.jsxs("p",{className:"mb-2",children:[e.jsx("strong",{children:"Methodology:"})," ",D]}),e.jsxs("p",{children:[e.jsx("strong",{children:"Disclaimer:"})," ",q]}),e.jsxs("p",{className:"mt-4 text-xs font-mono",children:["Last reviewed: ",O]})]})]})})]})})}export{ee as default};