The gap assessment scores 39 questions across the eight areas of the framework, on the same 0 to 4 maturity scale used by the DORA, ISO 42001 and CPS 234 modules.
What it is for, and how it differs from the requirements
The 72 requirement rows record whether each duty is implemented. The assessment measures whether the framework operates, which is what a supervisor tests. The questions deliberately do not restate the paragraphs. They ask what a reviewer asks: where the firm gets its complete list of suppliers from and how it knows the list is complete; what stops a business owner signing a contract before the five pre-contract steps are done, and when that control last blocked a signature; which subcontractors effectively underpin each critical service and how the firm found out; which single provider supports the most critical functions and what has been done about it; and, for the hardest provider to replace, who the alternative is, how long migration would take and when the plan was last walked through.
The Irish questions in the last area (the Central Bank return, offshoring appetite, outsourced control functions, what the local entity receives from the group) are answered by Irish-regulated firms. Other firms score them against the EBA duty they sit next to, or note in the answer that the Irish specific does not apply.
Scoring
| Score | Meaning |
|---|---|
| 0 | Not Implemented |
| 1 | Initial |
| 2 | Developing |
| 3 | Defined |
| 4 | Optimized |
Questions are weighted 1 to 3 by how much a reviewer cares about them. The overall percentage is computed against every question, answered or not, so an unanswered question reads as a gap rather than being excluded from the denominator. A score of 80 percent or above shows as substantially aligned, 50 to 79 as partial alignment, and below 50 as significant gaps.
Working through the areas
Five questions on the supplier inventory, the DORA boundary, the presumptions, re-assessment triggers and the paragraph 33 exclusions. The tell is a firm that has never re-classified anything.
The accountable role and its capacity, what the last policy review changed, the empty shell test, the management information that reaches the management body, and conflicts in intragroup pricing.
Whether the gate operates, how depth differs by tier, substitutability and the cost and time of transfer, licensable activities, and financial health reviews.
Clause coverage on provider paper, whether audit rights carry conditions and have ever been used, subcontractor visibility, the last objection, and whether the transition period matches the exit plan.
What arrives from each critical provider every quarter and who reads it, certification reliance, internal audit depth, the concentration decision and the corrective action trail.
Exit plan realism, exit triggers that are actually measured, provider continuity testing, the match between the BIA, the register and the SLA, and data recovery on exit.
Whether the register is the source of truth, which critical-only fields are empty, notification timing against start dates, the materiality definition, and how long a full export would take.
What the local entity receives from the group and decides on, the Central Bank submission scope and the February 2027 return, offshoring appetite and country risk, and outsourced control functions.
Notes and evidence on answers
Each answer takes a note and an evidence URL. Use the note to record the specific fact behind the score, for example the number of refusals the gate produced this year, the date of the last exit plan walkthrough, or the provider that supports the most critical functions and the decision taken about it. Those notes are what make a re-assessment next year meaningful rather than a fresh guess, and they are the sentences a supervisor's reviewer will ask you to repeat.