Book a demo

Regulation (EU) 2022/2554 · applies since 17 January 2025

Operational resilience you can evidence.

DORA asks EU financial entities to prove their ICT holds up - including the providers they rely on. Here is how CorebankOS helps you do that.

Book a DORA walkthrough
The five pillars

What DORA asks - and what we provide.

  1. ICT risk management

    DORA asks

    A documented ICT risk framework.

    We provide

    Asset inventory, change management and risk register extracts.

  2. Incident reporting

    DORA asks

    Classify and report major incidents.

    We provide

    Classification aligned to DORA criteria and timely notification to you.

  3. Resilience testing

    DORA asks

    Test ICT systems, including TLPT.

    We provide

    Annual scenario tests, recovery drills, TLPT participation.

  4. Third-party risk

    DORA asks

    Manage ICT providers and contracts.

    We provide

    Article 30 terms, sub-processor oversight, exit plan.

  5. Information sharing

    DORA asks

    Share cyber-threat intelligence.

    We provide

    Participation in threat-intelligence sharing arrangements.

Major ICT incidents

The reporting clock, and our part in it.

You report to your authority. We give you what you need, fast enough to meet each deadline.

  1. 0

    Detected

    We detect and start classification with you.

    Our notice to you: within 4 hours

  2. 4 h

    Initial notification

    Due within 4 h of classification, 24 h of awareness.

    Facts, impact and first assessment

  3. 72 h

    Intermediate report

    Due within 72 h of the initial notification.

    Status, root-cause hypothesis, actions

  4. 1 month

    Final report

    Due within one month of the intermediate report.

    Root cause, remediation, lessons learned

Article 30

Your contract, already compliant.

The provisions a contract with an ICT provider must include - each mapped to a clause in ours.

  • Services & service levels Order form · SLA schedule
  • Data locations Data processing addendum
  • Incident assistance Security schedule
  • Audit & inspection rights Audit clause
  • Termination rights Term & termination
  • Exit strategy Exit plan · transition support
  • TLPT participation Resilience schedule
  • Subcontracting conditions Sub-processor clause
Exit strategy

Leaving is planned, too.

A tested exit plan is part of every contract - because DORA expects it, and because trust needs an exit.

  1. Month 0

    Notice

    Termination notice triggers the exit plan and a named transition lead.

  2. Months 1–6

    Parallel run

    Full data exports and a parallel-run period with your new provider.

  3. Month 6+

    Hand-over

    Final data return in open formats, deletion certificate, closure report.

DORA readiness pack

Control mapping, register-of-information data, BCP/DR summary and exit plan · updated Aug 2026