ICT risk management framework
A documented framework, approved and reviewed by the management body, which bears ultimate responsibility for ICT risk.
Regulation (EU) 2022/2554 · DORA
Manage DORA from a single platform.
DORA has applied since January 17, 2025. Audexa brings together the assessment of all 81 controls, your ICT suppliers and contracts, the register of information and the evidence supervisors ask for, in one place.
- 81 controls across 14 domains
- Register of information in Excel
- ICT suppliers and contracts
81 DORA controls with guidance, suggested evidence and remediation
14 domains, from ICT risk to critical third parties
S01–S19 ICT service types based on the EU ITS templates
46 DORA ↔ ISO 22301 mappings to reuse work
What DORA requires
DORA is already mandatory, and supervisors are already asking for proof.
The regulation applies directly to banks, payment and e-money institutions, investment firms, asset managers, insurers, crypto-asset service providers and other financial entities. Compliance is supervised by national competent authorities and the European Supervisory Authorities (ESAs).
Major incidents
Classification and reporting to the supervisor: initial notification within 4 hours of classification (no later than 24 hours after detection), an intermediate report within 72 hours and a final report within one month.
Resilience testing
A testing program proportionate to size and risk, plus threat-led penetration testing (TLPT) for designated entities.
ICT third-party risk
A third-party strategy, minimum contractual clauses, exit strategies and control of concentration risk.
Register of information
An inventory of all arrangements with ICT providers, following the EU implementing templates, submitted to the supervisor.
Information sharing
Arrangements for securely sharing cyber threat intelligence with other financial entities.
Sources: Regulation (EU) 2022/2554 (EUR-Lex) · Implementing Regulation (EU) 2024/2956 (EUR-Lex) · INCIBE: reporting major incidents under DORA (in Spanish)
How Audexa helps
Centralized DORA control, from assessment to the register.
Assessment, ICT third parties, evidence and reports connected, so every requirement has an owner, a date and proof.
Assess
Know where you really stand against the regulation.
Guided DORA audit
81 controls across 14 domains, with interpretation guidance, suggested evidence and acceptance criteria.
Justified applicability
Exclude controls that don't apply to your entity, with a justification that stays with the results.
ISO 22301 mapping
46 links between DORA and ISO 22301 to build on the continuity work you already have.
Govern ICT third parties
Suppliers and contracts with the data DORA needs.
Suppliers with LEI
Supplier record with legal name, tax ID, validated LEI, country, criticality and dependencies.
Contracts with DORA data
ICT service type, critical or important function, substitutability, exit plan, governing law and subcontractors.
Notice-period alerts
Alerts 90, 60 and 30 days before the notice deadline and the expiry date, also shown in the calendar.
Prove
Have ready what the supervisor will ask for.
Register of information
Export the “Register of information (DORA)” sheet to Excel, with one active contract per row.
DORA policies
Templates for digital operational resilience, resilience testing, threat intelligence and reporting to authorities.
Management report
Executive and technical report with progress over time, gaps, risks and a roadmap.
Some features depend on your plan and active modules.
Register of information
Build your DORA register of information from your contracts.
Every contract with an ICT provider feeds the register. Audexa exports a sheet with the columns of the EU implementing templates, ready to review and adapt to your supervisor's submission format.
- Arrangement reference, provider, LEI, tax ID and country
- ICT service type (S01–S19), dates and notice days
- Critical or important function, substitutability and exit plan
- Annual cost, currency, governing law and subcontractors
ICT third parties
Manage your ICT providers without missing a notice deadline.
Suppliers, contracts, SaaS and dependencies in a single inventory. Audexa warns you before a notice period runs out and flags what needs attention: personal data without a DPA, MFA not enabled or critical suppliers without an owner.
- Contracts with auto-renewal and notice dates
- Owner and periodic review based on criticality
- Documented offboarding: what happened to the data
- Links to controls, evidence, risks and tasks
ICT incidents
Check that you can report a major incident on time.
The DORA audit assesses incident classification, severity criteria and the deadlines for initial, intermediate and final reports. Gaps become tasks and a ready-to-approve procedure for reporting to authorities.
- Controls for ICT incident classification and reporting
- Template procedure for reporting to authorities
- Owners and dates to close each gap
- Evidence of tests and drills in the evidence vault
Major incident reportingDORA deadlines
- Initial notification4 h after classification
- Intermediate report72 h
- Final report1 month
- Approved procedurev2 · signed
How it works
From an initial DORA snapshot to a program that lasts.
Assess your position
Complete the DORA audit, justify what doesn't apply and get gaps prioritized by weight and risk.
Organize your ICT third parties
Load suppliers and contracts with DORA data and get the register of information ready.
Remediate and prove
Assign tasks, approve policies, gather evidence and share the report with management.
Before and after
DORA in spreadsheets vs. DORA in Audexa.
AreaWithout a platformWith Audexa
Register of information
Excel rebuilt by hand every year
Exported from live contracts
Contract notice periods
Discovered too late
Alerts at 90, 60 and 30 days
DORA gaps
Static consulting report
Tasks with owners and expected evidence
Policies
Documents with no version or signature
Approval and signature workflow with history
Continuity
Duplicated work with ISO 22301
Cross-framework mappings
Frequently asked questions
What people usually ask us about DORA.
Who does DORA apply to?
To around twenty categories of financial entities: credit, payment and e-money institutions, investment firms, asset managers, insurers and reinsurers, crypto-asset service providers and market infrastructures, among others. ICT providers to these entities also receive requirements through their contracts.
Does Audexa generate the register of information?
Audexa exports an Excel sheet with the fields of the EU implementing templates, built from your contracts and suppliers. It helps you prepare and review the data; the technical submission format is set by each supervisor.
Does Audexa report incidents to our supervisor?
No. Audexa assesses your classification and reporting process and helps you document the procedure and close gaps, but reports are submitted through your competent authority's channels.
If we comply with DORA, do we need to worry about NIS2?
For financial entities, DORA acts as sector-specific legislation that takes precedence over NIS2 for ICT risk management and incident reporting. Even so, Audexa lets you assess both frameworks and reuse evidence.
Which plan do I need for DORA?
The DORA framework is available on the Premium and Diamond plans. In the demo we review what fits your number of users, contracts and suppliers.
Where is the data hosted?
Audexa runs on EU infrastructure, with role-based access, two-factor authentication and activity traceability.
Request a demo
Let's look at DORA with your real suppliers.
In 30 minutes we show you the DORA audit, ICT contract management and the register of information export.
- We review which DORA chapters affect you most.
- We show you how the register of information is built.
- We explain which plan fits your entity.