Would your DORA posture survive a supervisory review? Twelve questions across four domains — ICT risk management, incident classification & reporting, resilience testing, and third-party risk. Deterministic scoring, graded A–F, remediation map, and a §4 hash-anchored OpenChainGraph artifact for your audit trail.