DORA-compliant in 90 days
DORA compliance software for EU-regulated financial entities and the ICT third parties that serve them. Covers all 5 pillars of Regulation (EU) 2022/2554: ICT risk management, the 4h/72h/1mo incident clock, basic resilience testing plus TLPT, the Register of Information, Article 30 contract clauses, and cyber threat intelligence sharing. Cross-mapped to ISO 27001:2022, ISO 22301:2019, NIS2, and EBA Guidelines so existing evidence carries forward.
- ICT asset inventory + Articles 5-16 risk framework
- Article 18 + 19 incident clock: 4 hours · 72 hours · 1 month
- Article 28 Register of Information + Article 30 contract clauses
- Articles 26-27 TLPT workspace, TIBER-EU aligned
- Cross-mapped to ISO 27001 + ISO 22301 + NIS2 + EBA Guidelines
Trusted by chief risk officers, CISOs, and ICT third-party risk leads at banks, insurers, investment firms, and the ICT providers that serve them
What is DORA compliance software?
DORA compliance software automates the obligations set by the Digital Operational Resilience Act, Regulation (EU) 2022/2554. RiskWatch covers the 5 pillars: ICT risk management (Articles 5-16), ICT-related incident management + reporting on the 4-hour / 72-hour / 1-month cadence (Articles 17-23), digital operational resilience testing including TLPT every 3 years for significant entities (Articles 24-27), ICT third-party risk management with the Register of Information and Article 30 contract clauses (Articles 28-44), and cyber threat information sharing (Article 45). Cross-mapped to ISO 27001:2022, ISO 22301:2019, NIS2 Directive, and EBA Guidelines.
The pillars are clear. The Register of Information is what is breaking.
Financial entities face four recurring pains heading into the 31 March 2026 RoI submission and the next round of basic resilience testing. RoI data quality. Incident classification on the 4-hour clock. TLPT scoping for significant entities. And penalty math that scales with global turnover.
The Register of Information failed for 93% of firms in the ESA dry run.
Only 6.5 percent of nearly 1,000 firms passed all 116 data quality checks in the European Supervisory Authorities dry-run exercise. The most common failures: incomplete contract data, missing subcontractor information, invalid LEI codes, and incorrect criticality classifications. The RoI module collects Article 28 contractual fields once, validates LEI codes against GLEIF, and produces the ITS template every 31 March.
Major ICT incidents must be reported on a 4-hour, 72-hour, and 1-month cadence.
Article 19 plus the incident-reporting RTS require an initial notification within 4 hours of classification, an intermediate report within 72 hours, and a final report within one month. Teams without a classification engine cannot decide what is major versus significant cyber threat in time. RiskWatch ships the Article 18 classification criteria (clients affected, data losses, reputational impact, duration, geographical spread, criticality, economic impact) as a decision flow with the regulatory clock running.
Threat-led penetration testing every 3 years for significant entities.
Articles 26 and 27 oblige significant financial entities to run threat-led penetration tests (TLPT) at least every three years under the TIBER-EU framework. The scope, providers, threat intelligence, red team, and remediation evidence sit across four vendors and three internal teams. The Digital Operational Resilience Testing module ties scope, provider attestations, threat scenarios, and Article 24 remediation actions into one auditable record.
Penalty math reaches 2% of global turnover for critical third parties.
Critical ICT third-party service providers designated under Article 31 face periodic penalty payments of up to 1 percent of average daily worldwide turnover for each day of non-compliance, applied for up to six months. National competent authorities can fine entities under their domestic regimes (e.g. up to €5 million in Germany, €1 million for individuals). The Penalty Exposure dashboard converts gaps to euro-per-day per entity.
Regulation (EU) 2022/2554. In force since 17 January 2025.
DORA is the Digital Operational Resilience Act, a directly applicable EU regulation that harmonises digital operational resilience requirements across the EU financial sector. It covers banks, insurers, investment firms, payments, crypto-asset service providers under MiCA, market infrastructure, and the ICT third parties that serve them. See the consolidated text at EUR-Lex and supervisory guidance from EIOPA, EBA, and ESMA. Application is universal across in-scope entities from 17 January 2025, with the regulatory technical standards and implementing technical standards published in two batches in July and November 2024.
Five pillars, one platform. Built around the management body.
DORA is risk-based and outcome-driven. The 5 pillars cover ICT risk management (Articles 5-16), incident management + reporting (Articles 17-23), digital operational resilience testing (Articles 24-27), ICT third-party risk management with the Register of Information at the centre (Articles 28-44), and information + intelligence sharing (Article 45). All of them roll up to the management body under Article 5, which approves the framework and reviews it at least annually.
Pillar 1 · ICT risk management
Articles 5-16Scope: Articles 5-16. ICT risk management framework, governance + control, identification + protection + detection + response + recovery + learning + evolving + communication functions. Annual review by management body. Simplified regime for micro-enterprises under Article 16.
Obligation: Board-approved ICT risk framework, ICT business continuity policy, ICT response + recovery plans, backup + restoration testing, learning + evolution loop.
Pillar 2 · ICT-related incident management + reporting
Articles 17-23Scope: Articles 17-23. Major ICT incident classification, initial notification within 4 hours of classification, intermediate report within 72 hours, final report within 1 month. Significant cyber threats notified on a voluntary basis. Payment-related incidents under Article 23.
Obligation: Incident management process, classification criteria per Article 18, ESA reporting template, root-cause analysis, lessons learned in the ICT risk framework.
Pillar 3 · Digital operational resilience testing
Articles 24-27Scope: Articles 24-27. Basic testing for all entities: vulnerability assessments, scans, source-code reviews, scenario-based tests, performance + end-to-end tests. Advanced TLPT every 3 years for significant entities under the TIBER-EU framework.
Obligation: Annual test programme, independent testers, remediation tracking under Article 24, TLPT scope sign-off by competent authority, attestations for cross-border testing.
Pillar 4 · ICT third-party risk management
Articles 28-44Scope: Articles 28-44. Register of Information (Article 28), criticality assessment (Article 29), pre-contractual due diligence (Article 28), contractual provisions (Article 30), Oversight Framework for Critical ICT Third-Party Providers (Articles 31-44) operated by Lead Overseer (one of EBA, ESMA, EIOPA).
Obligation: RoI submission by 31 March each year, Article 30 contract clauses for all ICT services, exit strategies for critical or important functions, concentration risk monitoring, subcontracting chain mapping.
Pillar 5 · Information + intelligence sharing
Article 45Scope: Article 45. Voluntary exchange of cyber threat information + intelligence among financial entities within trusted communities. ENISA and ESAs encouraged to facilitate. Compatible with confidentiality + competition + data-protection rules.
Obligation: Where the entity participates, document the framework, the participants, the kind of information shared, and how Article 45 § 3 conditions are met.
Six in-scope cohorts. Plus every ICT provider serving them.
Article 2 scopes DORA to 21 types of EU financial entity plus ICT third-party service providers. The Oversight Framework for Critical ICT Third-Party Providers (CTPPs) under Articles 31-44 brings cloud, software, data analytics, and data-centre providers into direct supervision when they reach significance thresholds set in the Commission's delegated acts.
Credit institutions + banks
All credit institutions in Article 2 of Directive 2013/36/EU. The largest pillar by headcount and ICT spend. Significant institutions (SREP categories 1-2) face the full TLPT regime under Articles 26-27. Cross-mapped to EBA Guidelines on outsourcing arrangements + ICT and security risk management.
Investment firms + market participants
Investment firms under MiFID II, central counterparties, central securities depositories, trading venues, trade repositories, securitisation repositories, alternative investment fund managers, UCITS management companies. Significant firms in scope for TLPT.
Insurance + reinsurance undertakings
Insurance + reinsurance undertakings under Solvency II, insurance + reinsurance intermediaries, ancillary insurance intermediaries, institutions for occupational retirement provision (IORPs) above the size threshold. EIOPA acts as Lead Overseer for designated CTPPs in this segment.
Payments + e-money + crypto
Payment institutions, electronic money institutions, account information service providers, crypto-asset service providers under MiCA, issuers of asset-referenced tokens. Article 23 payment-related incident reporting overlays for credit + payment + e-money institutions.
Credit rating + ratings agencies + crowdfunding
Credit rating agencies, administrators of critical benchmarks, crowdfunding service providers, securitisation repositories. The DORA scope catches the data + ratings + benchmarks + crowdfunding plumbing alongside the regulated FS entities.
ICT third-party service providers
Cloud computing services, software, data analytics services, data centres. Direct DORA exposure for entities designated Critical ICT Third-Party Providers under Article 31 by the ESAs (EBA + ESMA + EIOPA). Indirect exposure for every provider serving an FS customer because Article 30 contract clauses are non-negotiable.
Every module a DORA programme needs, in one platform.
Sixteen modules sharing the ICT asset inventory, evidence vault, and audit trail. Built around the Articles 5-16 lifecycle so the Register of Information, the 4h/72h/1mo incident clock, the basic + advanced testing programme, and the Article 45 sharing record all read from the same source of truth.
Pillar-by-pillar coverage at a glance
Per-entity ICT risk health, RoI submission readiness, open incidents on the 4h/72h/1mo clock, test coverage versus the 3-year cycle, penalty exposure totals in euros.
Every asset, every dependency
Article 8 ICT-supported business function inventory. Information assets, ICT assets, data flows, dependencies on third parties tagged for Article 28 RoI feeding.
Articles 5-16 lifecycle
Risk identification, classification, protection + prevention, detection, response + recovery, learning + evolving, communication. Annual review workflow signed by the management body.
Article 18 + RTS criteria engine
Decision flow across the seven Article 18 criteria: clients affected, reputational impact, duration, geographical spread, data losses, criticality, economic impact. Major / non-major / significant cyber threat output with audit trail.
4 hours · 72 hours · 1 month
Article 19 reporting workflow. Initial notification within 4 hours of classification, intermediate report within 72 hours, final report within 1 month. Submission via national competent authority channel with ITS template.
Article 24-25 basic testing
Vulnerability assessments, scans, source-code reviews, scenario-based tests, performance + end-to-end tests, physical security reviews. Annual programme, independent tester evidence, remediation under Article 24 § 5.
Article 26-27 threat-led pen testing
TIBER-EU aligned. Threat intelligence provider, red team, blue team coordination, scope sign-off by competent authority, attestations under Article 27 § 6 for cross-border tests. Run at least every 3 years for significant entities.
Article 28 RoI builder + GLEIF validation
All ICT third-party contractual arrangements captured once. ITS template fields populated, LEI codes validated against GLEIF, criticality flags applied, subcontractor chain mapped, 31 March submission generated as CSV + XBRL.
Article 28-29 pre-contractual diligence
Vendor questionnaires, criticality scoring, concentration risk indicators, ESG + sub-outsourcing chain capture, gap-to-DORA contract clauses identified before signature.
Article 30 mandatory provisions
Article 30 § 2 clauses for all ICT services and § 3 additional clauses for critical or important functions. Termination rights, exit strategy, audit + access rights, location of data + processing, subcontracting + change management, security + business continuity.
Article 28 § 8 exit plans
For critical or important functions: exit triggers, transition plan, alternative provider readiness, data-portability testing, severability + reversibility milestones reviewed annually.
Articles 31-44 Lead Overseer evidence
When a third party is designated a Critical ICT Third-Party Provider, surface oversight recommendations, follow-up actions, and Article 42 enforcement signals. Useful both for FS entities consuming CTPPs and for ICT providers preparing for designation.
Article 29 portfolio view
Visualise concentration of critical or important functions on a single provider or a small set, factor sub-outsourcing chains, geographic concentration, single-point-of-failure flags. Feeds Article 28 § 9 strategy on ICT third-party risk.
ISO 22301 + ISO 27001 + NIS2 + EBA Outsourcing
DORA Article 5 ↔ ISO 27001 A.5.1 + ISO 22301 Cl 5 + NIS2 Article 21 § 2(a). Score one control, satisfy four regimes for financial entities already under ISO 27001 + ISO 22301.
Business-function recovery objectives
RTO + RPO + impact tolerance per ICT-supported business function. Aligns to Bank of England + PRA SS1/21 Operational Resilience expectations for UK groups and the FSB Cyber Lexicon.
Who changed what, answered instantly
Timestamped log of every RoI field edit, incident reclassification, test scope change, contract clause update. Admissible to national competent authorities and Lead Overseers.
From Article 5 governance to Article 45 sharing, the spine of DORA.
DORA articles cluster cleanly by pillar. Articles 5-16 carry the ICT risk management framework with the management body in Article 5. Articles 17-23 carry incident management + reporting plus the payment-related overlay. Articles 24-27 carry basic testing and the TLPT regime aligned to TIBER-EU. Articles 28-44 carry third-party risk: the Register of Information (Article 28), contract clauses (Article 30), the Oversight Framework (Articles 31-44). Article 45 carries information sharing. Each Article links to RTS or ITS adopted in 2024 that operationalise the language.
Score one control. Satisfy four regimes.
EU financial entities running ISO/IEC 27001:2022 + ISO 22301:2019 already cover roughly 70-80 percent of DORA Articles 5-16. Add NIS2 (Directive (EU) 2022/2555) for shared infrastructure and EBA Guidelines for outsourcing, and the same control answer satisfies four regimes. RiskWatch maps every DORA Article to the ISO clause, the ISO 27001 Annex A control, and the NIS2 Article 21 + 23 obligation.
| DORA | Duty | ISO 22301:2019 | ISO/IEC 27001:2022 | NIS2 Directive |
|---|---|---|---|---|
| Articles 5-6 | ICT risk management framework + governance | Clause 5 Leadership + Clause 6 Planning | Clause 5 Leadership + Annex A 5.1 Policies + 5.2 Roles | Article 20 § 1 management body accountability |
| Article 8 | Identification of ICT-supported business functions + assets | Clause 8.2.2 Business impact analysis | Annex A 5.9 Inventory of information + assets | Article 21 § 2(a) risk analysis + information system security |
| Articles 9-10 | Protection + prevention + detection of ICT incidents | Clause 8.4 Business continuity strategies | Annex A 8.7 Protection against malware + 8.16 Monitoring | Article 21 § 2(b) incident handling + (d) supply chain security |
| Article 11 | Response + recovery + ICT business continuity policy | Clause 8.4.4 Recovery + Clause 8.5 Exercise + testing | Annex A 5.29 + 5.30 ICT readiness for business continuity | Article 21 § 2(c) business continuity + crisis management |
| Article 12 | Backup policies + restoration + recovery procedures | Clause 8.4.4 Recovery + Annex A.17 | Annex A 8.13 Information backup | Article 21 § 2(c) backup management + disaster recovery |
| Articles 17-18 | ICT-related incident management process + classification | Clause 8.4.3 Incident response structure | Annex A 5.24-5.27 Incident management + lessons learned | Article 23 incident reporting (similar 24h / 72h / 1mo cadence) |
| Article 19 | Reporting major incidents: 4h initial / 72h intermediate / 1mo final | Clause 8.4.3 Communication | Annex A 5.5 Contact with authorities | Article 23 § 4: early warning 24h, incident notification 72h, final report 1mo |
| Articles 24-25 | Basic digital operational resilience testing programme | Clause 8.5 Exercise programme | Annex A 8.29 Security testing + 8.34 Audit testing | Article 21 § 2(f) testing the effectiveness of measures |
| Articles 26-27 | Threat-led penetration testing every 3 years for significant entities | Not directly covered | Annex A 8.29 Security testing of development + acceptance | Not directly required (NIS2 references resilience tests in general) |
| Article 28 | Register of Information + Article 30 contract clauses | Clause 8.3.2 Supply chain continuity | Annex A 5.19-5.22 Supplier relationships | Article 21 § 2(d) supply chain security + Article 22 EU-coordinated risk assessments |
| Article 45 | Voluntary cyber threat information + intelligence sharing | Clause 7.4 Communication | Annex A 5.6 Threat intelligence + 5.7 Sharing | Article 29 cyber threat intelligence sharing arrangements |
Sources: ISO/IEC 27001:2022 + ISO 22301:2019 standards, NIS2 Directive (EU) 2022/2555, EBA/GL/2019/02 + EBA/GL/2019/04 Guidelines, EIOPA Guidelines on ICT security + governance (EIOPA-BoS-20/600), ENISA NIS2 implementation guidance.
Answer once. Satisfy DORA + NIS2 + ISO 22301 + ISO 27001.
EU financial entities typically run four regimes in parallel: DORA for digital operational resilience, NIS2 for shared infrastructure, ISO 27001:2022 for information security management, and ISO 22301:2019 for business continuity management. RiskWatch maps the Article 5 governance, Article 11 BCP, Article 17-19 incident pipeline, and Article 28 third-party register to their ISO + NIS2 counterparts so a single evidence set satisfies all four. Customers running the four in parallel reduce combined audit prep by 55-65 percent.
From ICT asset inventory to Article 45 sharing, in eight ordered steps.
The order matters. Asset inventory before risk framework, framework before RoI, RoI before contract re-papering, contracts before the incident clock, incident clock before basic testing, basic testing before TLPT, TLPT before the annual management body review. RiskWatch enforces the order so nothing skips ahead and nothing gets left behind.
Inventory ICT-supported business functions + assets
Article 8 information + ICT asset inventory. Map functions to applications, infrastructure, data flows, third parties. Identify critical or important functions early because the Article 28 + Article 30 + Article 11 obligations track them.
Stand up the Article 5-16 ICT risk management framework
Board-approved policy, identification + protection + detection + response + recovery + learning + evolving + communication functions, annual review by the management body. Pull from your existing ISO 27001 + ISO 22301 base where present.
Build the Register of Information (Article 28)
Every ICT third-party contractual arrangement, LEI codes validated, criticality flags applied, subcontractors mapped. Reference date 31 December, submission to national competent authority by 31 March each year.
Update contracts to Article 30 § 2 + § 3 clauses
Termination + exit, audit + access rights, location of data, security + business continuity, change + subcontracting management, service-level + recovery objectives. Re-paper or risk loss of access to critical providers.
Wire the incident classification + reporting clock
Article 18 + RTS criteria operationalised as a decision flow. Initial 4 hours, intermediate 72 hours, final 1 month. Connect to the national competent authority reporting channel and the ITS template format.
Run the Articles 24-25 basic testing programme
Annual vulnerability scans, source-code reviews, scenario tests, performance tests, physical security reviews. Track remediation under Article 24 § 5. Independent tester evidence retained for the supervisor.
Scope + run TLPT every 3 years (significant entities)
Article 26-27. TIBER-EU framework, scope sign-off by competent authority, accredited threat intelligence + red team providers, attestation under Article 27 § 6. Output feeds Article 24 § 5 remediation.
Operate Article 45 information sharing + annual review
Voluntary participation in trusted communities for cyber threat intelligence. Annual ICT risk framework review by the management body. Lessons-learned loop closes back into Articles 5-16.
Up to 2% of worldwide turnover or €10M for entities, €1M for individuals.
DORA Article 50 obliges Member States to lay down effective, proportionate, and dissuasive administrative penalties. National regimes are now in place across the EU. For Critical ICT Third-Party Providers under Article 35, the Lead Overseer can impose periodic penalty payments up to 1 percent of the average daily worldwide turnover, applied for up to six months. Practical exposure scales with global turnover, not EU revenue.
Article 35. Designated Critical ICT Third-Party Providers face periodic penalty payments of up to 1 percent of average daily worldwide turnover, applied per day, for up to six months. Cumulatively reaches close to 2 percent of annual worldwide turnover.
Member-state ceilings vary. Ireland: the larger of €10 million or 10 percent of total annual turnover. Germany: up to €5 million. Italy: up to 10 percent of total annual turnover. Always check the national competent authority enforcement decision register.
Several Member States make senior individuals personally liable for serious DORA breaches under domestic financial services law. Germany sets a €1 million ceiling for individuals; Ireland and the Netherlands apply similar individual-accountability provisions tied to fit-and-proper testing.
Source: Article 35 + Article 50 of Regulation (EU) 2022/2554 plus national transposition acts in Germany (FinmadiG), Ireland (Central Bank Act), Italy (Legislative Decree 23/2024), and other Member States.
How RiskWatch compares to Drata, Vanta, and Panorays
Public feature comparison drawn from each vendor's own DORA product pages (audited 2026-05-15) plus aggregated G2 and Capterra commentary. DORA software covers three different jobs: GRC compliance automation (Drata + Vanta), third-party risk specialist (Panorays + ProcessUnity), and integrated FS operational resilience (RiskWatch). Many EU financial entities need more than one. The right buying decision usually starts with identifying who owns the Register of Information.
| Capability | RiskWatch | Drata | Vanta | Panorays |
|---|---|---|---|---|
| Article 28 Register of Information builder + ITS XBRL output | Yes, native, GLEIF LEI validation + 31 March submission generator | Partial, DORA framework library, manual RoI assembly | Partial, DORA framework library, manual RoI assembly | Partial, focus is vendor questionnaire + risk score |
| Article 18 incident classification engine (7 criteria) | Yes, decision flow with audit trail per incident | Partial, evidence collection only | Partial, evidence collection only | No |
| Article 19 reporting clock (4h / 72h / 1mo) with ITS template | Yes, timer-driven workflow + ITS-aligned export | Manual | Manual | No |
| Article 26-27 TLPT workspace (TIBER-EU) | Yes, scope + threat intel + red team + remediation tracking | No native TLPT module | No native TLPT module | No |
| Article 30 contract clause manager | Yes, § 2 + § 3 clause library, re-paper workflow | Template repository | Template repository | Partial, captured via questionnaire |
| Article 28 § 8 exit strategy builder | Yes, dedicated, with severability + portability milestones | Template | Template | No |
| DORA + NIS2 + ISO 22301 + ISO 27001 cross-mapping | Yes, configurable, score-once-satisfy-four | Yes, 30+ framework Common Controls | Yes, framework library | Yes, third-party-only scope |
| CTPP oversight evidence (Articles 31-44) | Yes, Lead Overseer recommendation + Article 42 follow-up tracking | No | No | Partial, vendor-side risk view |
| Cyber threat intelligence sharing (Article 45) | Yes, structured community + ISAC integration record | No | No | No |
| Pricing transparency | Quote per scope + framework count, no surprise renewal jumps | Quote-only, scales with org size | Quote-only, criticised for renewal jumps | Quote-only |
DORA programmes that survive the supervisor
Real CROs, CISOs, and ICT third-party risk leads running DORA on top of ISO 27001 + ISO 22301. Composite benchmarks from RiskWatch deployments. The biggest single ROI lever: turning the Register of Information from an annual scramble into a continuous record.
Six ICPs running DORA on the same platform.
Bank, insurer, investment firm, ICT provider. EU domicile, UK group with EU branches, US or APAC parent with EU subsidiaries. The pillars are universal; the management body, the criticality classification, and the test scope set the work.
CROs + CISOs at EU-regulated financial entities
Banks, investment firms, insurers, payments. Primary buying centre. Reports to management body under Article 5. Owns the ICT risk framework, the 4h/72h/1mo incident clock, and the test programme. Cross-maps to EBA Guidelines on ICT + security risk management + Solvency II + MiFID II.
ICT third-party risk leads
Owns the Register of Information, Article 30 contract programme, exit strategies, concentration risk reporting. The single most resource-consuming workstream in DORA: 46 percent of institutions named the RoI as the most challenging requirement per Deloitte 2025.
ICT third-party service providers serving FS
Cloud, software, data analytics, data centres. Indirect exposure today via Article 30 contract clauses imposed by FS customers. Direct exposure if designated a Critical ICT Third-Party Provider under Article 31 by EBA / ESMA / EIOPA Lead Overseers.
UK groups operating in the EU under SS1/21
UK PRA-regulated firms running EU subsidiaries face DORA in the EU branch and PRA Operational Resilience SS1/21 + Bank of England + FCA expectations in the UK. RiskWatch maps the impact-tolerance + important-business-services language to DORA pillars.
EU branches of US + APAC financial groups
Goldman, JPM, Morgan Stanley, Mizuho, Sumitomo, MUFG EU subsidiaries are in scope. Headquarters group standards (NIST CSF 2.0 + FFIEC CAT + APRA CPS 230) cross-map. RoI submission still happens in the EU subsidiary jurisdiction.
Crypto-asset service providers + MiCA scope
Crypto-asset service providers authorised under MiCA fall under DORA. The 5 pillars apply alongside MiCA + AML + CRR. Particularly acute for the RoI submission because most CASPs run a heavy SaaS + exchange stack.
Plus every framework you run with DORA, cross-mapped.
Score one ICT risk control. Satisfy ISO 27001:2022, ISO 22301:2019, NIS2 Directive, and EBA Guidelines on outsourcing simultaneously.
DORA Compliance Roadmap (5 Pillars + Register of Information)
A 40-page PDF walking the eight-step compliance roadmap, the Register of Information field-by-field template, the Article 18 incident-classification decision flow, and the ISO 27001 + ISO 22301 + NIS2 cross-mapping reference. Updated with the 2024 RTS + ITS and the March 2026 RoI submission specifications.
- 5-pillar obligation checklist with Articles 5-45 references
- Register of Information ITS template with field-by-field guidance
- Article 18 + 19 incident classification + 4h/72h/1mo workflow
- Article 30 § 2 + § 3 contract clause library + exit-strategy template
- DORA + NIS2 + ISO 27001 + ISO 22301 cross-mapping reference table
What CROs and ICT third-party risk leads ask before they buy
About Regulation (EU) 2022/2554, the 5 pillars, the Register of Information, the 4h/72h/1mo incident clock, TLPT under TIBER-EU, ISO 22301 + ISO 27001 + NIS2 cross-mapping, Article 50 penalties, and how RiskWatch covers all of them.
Build your Register of Information this week
Start a 30-day free trial. Full ICT asset inventory, Articles 5-16 risk framework, Article 18 + 19 incident classification + reporting clock, Articles 24-25 basic testing programme, Articles 26-27 TLPT workspace, Article 28 Register of Information builder, Article 30 contract clause manager, Article 28 § 8 exit-strategy module, and cross-mapping to ISO 27001 + ISO 22301 + NIS2 + EBA Guidelines. No credit card.
No credit card required · 30-day free trial · Cancel anytime