# DORA · Trust Center · CorebankOS

> DORA asks EU financial entities to prove their ICT holds up, including the providers they rely on. How CorebankOS helps: the five pillars, incident reporting, Article 30 and a tested exit plan.

Source: https://corebankos.com/trust-center/dora

## Operational resilience you can evidence.

DORA asks EU financial entities to prove their ICT holds up - including the providers they rely on. Here is how CorebankOS helps you do that.

## What DORA asks - and what we provide.

### ICT risk management

A documented ICT risk framework.

Asset inventory, change management and risk register extracts.

ICT risk

### Incident reporting

Classify and report major incidents.

Classification aligned to DORA criteria and timely notification to you.

### Resilience testing

Test ICT systems, including TLPT.

Annual scenario tests, recovery drills, TLPT participation.

### Third-party risk

Manage ICT providers and contracts.

Article 30 terms, sub-processor oversight, exit plan.

Third parties

### Information sharing

Share cyber-threat intelligence.

Participation in threat-intelligence sharing arrangements.

Information sharing

## The reporting clock, and our part in it.

You report to your authority. We give you what you need, fast enough to meet each deadline.

### Detected

We detect and start classification with you.

Our notice to you: within 4 hours

### Initial notification

Due within 4 h of classification, 24 h of awareness.

Facts, impact and first assessment

### Intermediate report

Due within 72 h of the initial notification.

Status, root-cause hypothesis, actions

### Final report

Due within one month of the intermediate report.

Root cause, remediation, lessons learned

## Your contract, already compliant.

The provisions a contract with an ICT provider must include - each mapped to a clause in ours.

- **Services & service levels**: Order form · SLA schedule
- **Data locations**: Data processing addendum
- **Incident assistance**: Security schedule
- **Audit & inspection rights**: Audit clause
- **Termination rights**: Term & termination
- **Exit strategy**: Exit plan · transition support
- **TLPT participation**: Resilience schedule
- **Subcontracting conditions**: Sub-processor clause

## Leaving is planned, too.

A tested exit plan is part of every contract - because DORA expects it, and because trust needs an exit.

### DORA readiness pack

Control mapping, register-of-information data, BCP/DR summary and exit plan · updated Aug 2026

#### DORA readiness pack

### Notice

Termination notice triggers the exit plan and a named transition lead.

Month 0

### Parallel run

Full data exports and a parallel-run period with your new provider.

Months 1–6

### Hand-over

Final data return in open formats, deletion certificate, closure report.

Month 6+