Skip to content

DORA · Regulation (EU) 2022/2554

Run DORA as one programme, not five projects.

ICT risk, incidents, testing and third parties are separate chapters of DORA, but one operational reality. ILSERIS keeps them on one connected data model, so a control, the provider it depends on, the incident that tested it and the audit that checked it are linked records.

Request a demoHow ILSERIS maps

Requirements

What DORA asks of you

DORA applies to financial entities in the EU and sets uniform requirements for the security of their network and information systems. In broad terms, it covers six areas.

  • Governance and management body

    The management body defines, approves and oversees the ICT risk management framework and remains responsible for it.

    ILSERIS modules

  • ICT risk management framework

    Keep a documented framework to identify, protect against, detect, respond to and recover from ICT risk, and review it regularly.

    ILSERIS modules

  • ICT-related incident management, classification and reporting

    Detect, manage and record ICT-related incidents, classify them against the regulatory criteria and report major incidents to the competent authority.

    ILSERIS modules

  • Digital operational resilience testing

    Run a risk-based testing programme for your ICT systems and tools. Some entities must also carry out threat-led penetration testing.

    ILSERIS modules

  • ICT third-party risk

    Manage the risk of ICT service providers across the relationship, keep a register of information on all contractual arrangements and include the required contractual provisions.

    ILSERIS modules

  • Information sharing

    Optionally take part in trusted arrangements to exchange cyber threat information and intelligence with other financial entities.

    ILSERIS modules

Mapping

How ILSERIS maps to DORA

Five steps, each in a module you already use, all on the same records.

  1. Step 01

    Set up DORA as a framework

    Record DORA in Govern's frameworks and set which obligations apply to your organisation.

  2. Step 02

    Map obligations to controls

    Link each obligation to the controls, policies and owners that meet it, and see where the gaps are.

  3. Step 03

    Link risks, third parties and plans

    Connect controls to the ICT risks in the register, the third parties and contracts they rely on, and the impact analysis and recovery plans of your critical services.

  4. Step 04

    Run incidents and tests

    Handle incidents with classification and notification drafts, and plan, run and evaluate resilience tests.

  5. Step 05

    Audit and report

    Run DORA audit engagements, follow findings through to corrective actions and report coverage per obligation.

Outputs

What you can show

To your management body, your auditors and your supervisor.

  • Coverage per DORA obligation, with the controls, owners and gaps behind each one.
  • ICT third parties with their tiering, contracts, SLAs and renewal dates in one place, as input for your register of information.
  • Incident records with classification and drafts of regulatory notifications, reviewed and approved by a person.
  • A full audit trail: who changed what, with the values before and after.

ILSERIS supports your compliance programme. It does not provide legal advice or certify compliance.

See ILSERIS in action.

A focused walkthrough, built around your regulatory landscape and operating model.

Request a demoContact us