EU financial entities — the operational resilience regulation, automated.

What DORA asks. Pillar 1 covers governance (Art. 5), the written ICT risk management framework (Art. 6), ICT systems / protocols / tools (Art. 7), identification of assets including AI / ML (Art. 8), protection + prevention (Art. 9), detection (Art. 10), response + recovery (Art. 11), backup + recovery procedures (Art. 12), learning + evolving (Art. 13), communication (Art. 14), RTS harmonisation (Art. 15), simplified framework option for microenterprises (Art. 16).

What counts as compliant. A management-body-approved framework with documented policies, procedures and tools; a complete asset identification list (including AI / ML systems supporting business functions); operating detection + response + recovery capabilities; an annual review cycle plus extraordinary reviews on major changes; alignment with the Commission Delegated Regulation 2024/1774 RTS.

What Secruna ships for Pillar 1. 13 rules across Art. 5-16: board-approved governance, framework documented, asset identification reusing the Secruna inventory, secure configuration baseline, centralised audit logging, business-continuity testing, backup + restoration evidence, post-incident learning cycle, crisis communication plan, RTS-alignment audit, and the microenterprise classification check.

See this in your dashboard at: /inventory?framework=dora&pillar=P1 filtered to Pillar 1 IGPs, with per-Article verdict and connector-signal citation.

What DORA asks. Pillar 2 covers the ICT incident management process (Art. 17), classification of major incidents against the Art. 18(1) + Delegated Regulation 2024/1772 thresholds (services affected, duration, geographic reach, clients affected, economic impact, reputational impact), reporting to the competent authority on the 4h initial / 72h intermediate / 1-month final timeline (Art. 19), harmonised RTS templates (Art. 20), payment-incident overlay (Art. 23).

What Secruna ships for Pillar 2. Five rules covering the documented incident process, the Art. 18 classification taxonomy (manual today, auto- classification scaffolded under Plan 135), the 4h initial report, the 72h + 1-month follow-ups, the harmonised RTS template adoption and the payment-incident overlay.

See this in your dashboard at: /incidents with the DORA timeline tracker per incident, and /inventory?framework=dora&pillar=P2 for the Pillar 2 rule-book view.

What DORA asks. Pillar 3 covers the testing programme (Art. 24), the testing of ICT tools and systems including vulnerability assessments + scenario- based testing (Art. 25), threat-led penetration testing (TLPT — Art. 26) for entities designated by the competent authority, and the qualifications required of third-party testers (Art. 27). TLPT is required at least every three years for designated critical entities.

What Secruna ships for Pillar 3. Four rules. Art. 24 testing programme posture, Art. 25 vulnerability assessments + AI-system testing scope, Art. 26 TLPT scope check (tenant-attested in v1 — Secruna does not run pentests), Art. 27 third-party tester qualification evidence. The evidence pack surfaces the entity’s TLPT cycle so the supervisor sees what cadence is being maintained.

See this in your dashboard at: /inventory?framework=dora&pillar=P3 with the testing programme + TLPT cycle surfaced.

What DORA asks. Pillar 4 is the biggest new surface DORA introduces — and the biggest Secruna sales hook. Art. 28 mandates a register of all ICT third-party arrangements + preliminary due-diligence before contracts + exit strategies for critical functions. Art. 29 requires a concentration-risk assessment. Art. 30 lists the mandatory contractual provisions, with supplemental provisions required for ICT services supporting critical / important functions (KPIs, audit rights, TLPT participation, regulator access).

What Secruna ships for Pillar 4. Eight rules. The Art. 28(3) register reuses our AI systems inventory as a partial register (full ICT third-party coverage scaffolded under Plan 134); a third-party risk policy posture; pre-contract due-diligence template; exit strategy posture per critical-function arrangement; concentration-risk attestation; Art. 30 contract audit; Art. 30(3) supplemental-provisions audit for critical-function contracts; sub-outsourcing chain tracking; critical-provider designation awareness (ESAs list).

See this in your dashboard at: /inventory for the partial Art. 28 register +/inventory?framework=dora&pillar=P4 for the Pillar 4 rule-book view.

What DORA asks. Article 45 lets financial entities exchange amongst themselves cyber threat information + intelligence (IoCs, TTPs, cybersecurity alerts, configuration tools) within trusted communities of financial entities. Sharing is voluntary but must preserve confidentiality + comply with data-protection rules.

What Secruna ships for Pillar 5. One rule covering membership of a trusted financial-sector CTI community (FS-ISAC, sector CSIRT, regulatory CTI exchange) plus the data-flow posture. The information- sharing IGP feeds back into the Art. 13 learning + evolving cycle so the supervisor sees a closed loop.