DORA requires you to know which ICT providers your operations rest on.
For a payment institution, asset manager, insurer or intermediary without a big bank's third-party engineering: an ICT third-party register, an incident classifier and DORA indicators in the same risk loop, with concentration and blast radius.
- FAIR band always labelled as simulated and uncalibrated
- Data in the EU (OVH, Gravelines); Cloudflare (US) handles DNS, CDN and TLS on the request path
What DORA requires, in brief
DORA brings the digital-resilience requirements of financial entities into one regulation, with the principle of proportionality.
Informational summary, not legal advice. The scope and proportionality that apply to your entity depend on the current text and on your supervisor.
- Register of information
- Entities keep a register of all their contractual arrangements with ICT third-party providers (Article 28(3)).
- Key contractual provisions
- Contracts include, among others, exit strategies and rights of access, inspection and audit (Article 30).
- Classify and report incidents
- ICT incidents are classified against common criteria and major ones are reported to the supervisor (Articles 17 to 19).
- Concentration and dependency
- Before contracting, entities assess the concentration risk of their ICT providers (Article 29).
DORA's five pillars and where HodeiShield fits
We do not cover all of it. This is the part of the regulation the platform works on, and the part it does not.
II
ICT risk management
Exposure in euros per supplier and a risk register.
PartialIII
ICT incident management, classification and reporting
A classifier with DORA's criteria and a major-incident indicator.
PartialIV
Digital operational resilience testing
No resilience testing and no threat-led penetration testing.
Not coveredV
ICT third-party risk
Supplier register, exit plans, audit rights and concentration.
DirectVI
Information sharing
Sector threat radar as an input; it is not an information-sharing arrangement between entities.
Not covered
From each DORA obligation to a HodeiShield capability
With phase and scope. Only what the platform backs.
Direct: the platform does it. Partial: it supplies evidence or one part, the rest is yours. Not covered: outside HodeiShield.
- Obligation:
Register of information on arrangements with ICT providers
Art. 28(3)
What HodeiShield does:An ICT provider register with criticality, exit plans and audit rights. Submitting the register to the supervisor follows the official formats and channels; HodeiShield does not do that for you.
Demo · DORA viewPhaseSENSEScopePartial - Obligation:
Exit strategy and audit rights in contracts
Art. 30
What HodeiShield does:Shows per provider whether an exit plan and an audit right exist and calculates coverage over the total. Negotiating the clauses is yours.
Docs · Compliance (opens in a new tab)PhaseSENSEPREDICTScopeDirect - Obligation:
Assess ICT provider concentration risk
Art. 29
What HodeiShield does:HHI concentration and a 3-hop blast radius over the graph of declared dependencies.
Docs · Core concepts (opens in a new tab)PhasePREDICTScopeDirect - Obligation:
Classify ICT incidents and spot major ones
Art. 18
What HodeiShield does:A classifier with DORA's criteria: users affected, duration, data loss, critical functions, reputational and economic impact.
Demo · incident registerPhaseOutside the cycleScopePartial - Obligation:
Report major incidents to the supervisor
Art. 19
What HodeiShield does:The same single register that feeds NIS2 and GDPR. You prepare and send the notification content.
Demo · incident registerPhaseOutside the cycleScopePartial - Obligation:
ICT risk-management framework
Art. 6 and 8
What HodeiShield does:FAIR ALE in euros with a simulated uncertainty band (uncalibrated), a deterministic 7-scenario simulator and alerts routed to 9 destinations.
Docs · Risk engine (opens in a new tab)PhasePREDICTACTScopePartial - Obligation:
Ongoing monitoring of ICT providers
Art. 28
What HodeiShield does:Token-based questionnaires with reminders, periodic external scanning, daily CVEs and supplier SBOMs.
Docs · Risk engine (opens in a new tab)PhaseSENSEScopePartial - Obligation:
Indicators and evidence for management and the supervisor
Art. 5
What HodeiShield does:Six DORA indicators (providers, critical, exit plans, audit rights, incidents and major ones), an executive dashboard and an ATTEST attestation per framework band.
Demo · DORA viewPhaseATTESTScopePartial - Obligation:
Digital operational resilience testing
Ch. IV
What HodeiShield does:Outside HodeiShield.
PhaseOutside the cycleScopeNot covered
What HodeiShield does not do with DORA
What stays outside, said before the demo.
It does not file the register with the supervisor
It keeps the provider register and its indicators. Submission, in the official format and channel, is not a function we claim.
It does not run resilience tests
Neither scenario testing nor TLPT. They are a pillar of their own in DORA and stay outside.
FAIR is not a breach probability
It is a parametric point estimate in euros with a simulated uncertainty band (uncalibrated), using the model's sector parameters.
It is not real-time
The agent reports per cycle, provider scans are periodic and the CVE sync is daily.
Questions about DORA
Answers with the exact scope.
Does HodeiShield generate the register of information filed with the supervisor?
It keeps the register of your ICT providers with criticality, exit plans and audit rights, and calculates the indicators. We do not claim filing the register in the official format and channel: that part remains yours.
Which entities, and since when?
DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025 to the financial entities listed in its Article 2. Proportionality and simplified regimes depend on each entity.
How is FAIR calculated?
As a parametric point estimate in euros, always accompanied by a simulated uncertainty band (uncalibrated) and using the model's sector parameters. It is not presented as calibrated or validated.
Is it real-time?
No. The agent reports per cycle, provider scans are periodic and the CVE sync is daily.
Does it cover resilience testing?
No. HodeiShield works on third-party risk, incidents and indicators. Digital operational resilience testing stays outside.
Walk through your ICT register with a critical provider in front of you
In the demo we look at a critical-provider and concentration case: from the register to the indicator to the evidence for the supervisor.
No commitment. Sample data.