# DORA on AWS — Readiness Checklist (July 2026)

In force since **17 Jan 2025**. Soften legal claims; confirm with counsel.

## Scope

- [ ] Entity type under Art. 2 / ICT third-party role documented
- [ ] AWS workloads classified critical vs non-critical for RoI
- [ ] Review AWS DORA materials + addendum in **Artifact**

## Ops

- [ ] Org CloudTrail + GuardDuty + Security Hub (FSI pack where used)
- [ ] Major-incident clock runbook: classify → 4h / 24h / 72h / final
- [ ] Map findings → DORA classification RTS criteria
- [ ] TLPT / TIBER-EU plan for significant entities (≤3y cycle)
- [ ] Exit strategy for critical AWS-hosted functions (tested sketch)

## Counter-case

Signing the addendum ≠ RoI complete. Exit strategies fail first audits when unrehearsed.