DORA
The EU's Digital Operational Resilience Act (Regulation 2022/2554). In force since 17 January 2025, with no transition period. Harmonised ICT risk rules for ~22,000 financial entities.
Five pillars of ICT resilience, mandatory from day one.
DORA gives the EU financial sector a single ICT-resilience rulebook, replacing fragmented requirements across PSD2, MiFID II and Solvency II. It rests on five pillars: ICT risk management, incident management and reporting, digital operational resilience testing, third-party risk management, and cyber threat-information sharing.
It applies to roughly 22,000 financial entities — banks, insurers, investment firms, payment and e-money institutions, and crypto-asset service providers — with no transition period. Critical ICT providers like the major cloud platforms are under direct EU oversight.
The files this framework actually requires.
DORA names an ICT risk framework, a third-party register and testing records. Hael generates and maintains each.
GRC tools tell you these are missing. Hael generates them — from each system's real configuration.
A checklist tells you what's missing. Hael puts it on record.
A checklist asks for your ICT risk framework and third-party register. Hael generates both and keeps the register current as vendors change.
Discover, classify, produce — for DORA.
Find the systems in DORA scope, including embedded third-party AI.
Assess each against DORA's risk tiers and obligations.
Generate the DORA records, versioned and current.
Every obligation, mapped to the control that satisfies it.
Rows are the framework's clauses.
Columns are the controls and files that satisfy them.
Cells update as the underlying configuration changes.
Clause by clause.
Author once. Satisfy many.
DORA's ICT risk and third-party records overlap heavily with ISO 27001 and SOC 2 security controls, and with the EU AI Act where AI is part of a financial entity's ICT estate — build the control once, evidence it across all three.
Already mandatory — evidence resilience now, not at the next filing.
DORA has applied since January 2025 with no grace period. Hael produces the ICT risk framework, register and testing records it requires.