Dashboard Regulations DirectoryDigital Operational Resilience Act (DORA)

EU JurisdictionEnforceable Ruleset8 Active Controls

Digital Operational Resilience Act (DORA)

Authentic statutory obligations decomposed into atomic machine-actionable conditions, actions, and verification standards.

Official Legal Text

Criticalobligation98% AI Match

Detection of Anomalous Activities & Intrusions

Financial entities shall have mechanisms to promptly detect anomalous activities, including ICT network performance issues and ICT-related incidents (Article 10).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "24_7_siem_soc": true,
  "automated_anomaly_detection": true
}

Criticalobligation98% AI Match

ICT Risk Management Framework Governance

Financial entities shall have in place an internal governance and control framework that ensures effective and prudent management of ICT risk (Article 5).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "annual_review": true,
  "management_body_approval": true
}

Highobligation98% AI Match

Threat-Led Penetration Testing (TLPT)

Entities shall carry out advanced digital operational resilience testing, including Threat-Led Penetration Testing (TLPT) at least every 3 years for critical functions (Article 26).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "production_scope_tested": true,
  "crested_testers_mandated": true
}

Criticalobligation98% AI Match

Protection and Prevention Security Measures

Continuous monitoring and security tooling to prevent unauthorized access, mitigate data tampering, and ensure network segregation (Article 9).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "edr_deployed": true,
  "microsegmentation": true,
  "multi_factor_authentication": true
}

Highobligation98% AI Match

ICT Systems, Protocols, and Tools Maintenance

Financial entities shall use and maintain updated ICT systems, protocols and tools that are appropriate, reliable, technologically resilient and have adequate capacity (Article 6).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "capacity_monitoring": true,
  "supported_software_versions": true
}

Criticalobligation98% AI Match

Management of ICT Third-Party Risk

Financial entities shall manage ICT third-party risk as an integral component of ICT risk, maintaining a full Register of Information for all ICT service providers (Article 28).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "vendor_register_updated": true,
  "audit_rights_in_contracts": true
}

Highobligation98% AI Match

Identification of Business Functions & ICT Assets

Financial entities shall identify, classify and adequately document all ICT supported business functions, the information assets and the ICT assets fulfilling those functions (Article 8).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "interdependency_mapping": true,
  "critical_function_tagging": true
}

Criticalobligation98% AI Match

ICT Business Continuity and Disaster Recovery Policy

Comprehensive business continuity plans and disaster recovery arrangements subjected to regular testing and audit validation (Article 11).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "rpo_rto_defined": true,
  "annual_failover_test": true
}