Frameworks · DORA
The European regulation for digital operational resilience of the financial sector, directly applicable without national transposition. For banks, insurers, pension funds, investment firms and their ICT providers. In short: manage ICT risk with concrete measures and prove those measures are in place.
What it requires
Article 9 requires policies and controls for access rights, strong authentication, change management and patches and updates. The RTS adds secure configuration of every ICT system, and automated vulnerability scanning.
Article 10 demands mechanisms that detect anomalous activity as soon as possible, with multiple layers of control and alert thresholds. That only works if you know what the normal state is.
The management body defines the ICT risk management framework, approves it and oversees its implementation. The final responsibility sits there, not with the IT department or the provider.
How you make it demonstrable
Easy2audit measures your systems and accounts against the technical controls of chapter II of DORA, Articles 9 and 10, and their technical elaboration in RTS 2024/1774: secure configuration, access rights, authentication and patch management, and scores the same scan against the other frameworks as well.
In Easy2audit the settings are linked to the articles of DORA: identification (8), protection and prevention (9, including strong authentication, access restriction, network management and patching from paragraph 4), detection (10), backup (12), communication (14) and classification of incidents (18). Per article you see which systems deviate.
demo environment · sample scores · a selection, the application covers the full framework
Also measured
also available: NIST benchmarks · ISA 315 reporting for the financial statement audit