DORA makes resilience a board issue

You need a tested incident-response process, a register of ICT third parties, contractual resilience clauses and evidence of resilience testing. For lean teams the fastest path is proportionate: document the critical dependencies first, then close the contractual and testing gaps before they become findings.