Example scenario — not a live project yet. An illustrative depiction of a typical implementation.
Starting point
Under the Digital Operational Resilience Act (DORA), financial entities and their ICT providers have to manage their digital operational resilience demonstrably: documented ICT risk management, a complete register of all contractual arrangements with ICT third-party providers (the so-called register of information), and a classification of which ICT services support critical or important functions.
Consultancies in this space face the task of mapping these requirements for several clients consistently, auditably, and in the required supervisory format — work that in practice often lives in scattered spreadsheets: hard to keep current, barely audit-proof, and laborious to transfer into the authority's reporting format. A tool that captures this methodology could turn that recurring work into a reusable product of its own.
Solution approach
Such an application would be designed as a multi-tenant platform that covers the DORA due-diligence process end to end — from capturing ICT providers and contracts, through classifying critical and important functions, to an exportable register of information. A guided workflow would lead through risk identification, assessment, and remediation, so that every rating ends up fully derived and evidenced.
- Guided workflow from provider and contract capture to risk assessment
- Classification of ICT services by whether they support critical or important functions
- Register of information with export in the supervisory templates (ESA ITS)
- Concentration risks and dependencies on third- and subcontractors at a glance
- Measures board for preventive and remedial actions with roles, deadlines, and approvals
- Role-based and multilingual, with a complete audit trail and two-factor authentication
How it could look
Mockup / illustrative depiction — invented demo data, not a live system or product.
What the tool would deliver
Designed as a reusable product, such a tool could put a consultancy's DORA work onto the same traceable process across all clients. Instead of scattered spreadsheets, a structured source of data would emerge, from which the register of information and audit-ready evidence could be derived at any time.
- Would provide the register of information in the required supervisory format at any time
- Could map ICT risks and third-party dependencies consistently across all clients
- Would be designed as an audit-proof basis for audits and supervisory inquiries
- Would turn recurring advisory work into a scalable product under an own brand
