# Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation This site has an agentic ask interface you may use to query the documentation dynamically by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.doraedge.com/index.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. --- # Feature Descriptions ### Introduction Welcome to DORAedge, your comprehensive solution for ensuring compliance with the Digital Operational Resilience Act (DORA). This guide will help you navigate through the platform’s features and functionalities, ensuring a smooth and efficient experience. DORAedge is designed to simplify the complex requirements of DORA, providing you with the tools and insights necessary to maintain operational resilience in the face of digital risks. *** ### Getting Started #### Sign-Up and Onboarding **Self-Service Organization Creation** DORAedge allows for seamless self-service organization creation using Auth0. This ensures that your entity is set up securely and efficiently, aligning with DORA’s emphasis on robust identity and access management. **Database Provisioning and Migrations** Automated processes for database setup and migrations ensure that your data is managed securely and efficiently. This is crucial for compliance with DORA's requirements on data integrity and availability. **Low-Touch Sign Up and Billing** Our streamlined sign-up and billing processes minimize manual intervention, reducing the risk of human error and ensuring compliance with DORA’s operational resilience requirements. **Onboarding Checklist** Follow a step-by-step onboarding checklist on the "Get Started" page to ensure all necessary information and configurations are completed. This checklist is designed to help you quickly meet DORA’s requirements for ICT risk management and governance through completing essential tasks such as entering Entity information, Provider setup, and establishing contractual relationships. *** ### Supply Chain Network Management #### Entities and Branches **Entities Page** The Entities Page allows you to add and edit Entities with full functionality. This is essential for maintaining an up-to-date record of all entities involved in your ICT operations, as required by DORA. **Branches Page** Identify various operational or jurisdictional Branches within entities to accurately define relationships and risks. #### **Function and Systems** **Functions Page** Track licensed activities that are either managed in-house or outsourced to third-party ICT Providers, as well as define the criticality to your operations. **ICT Assets Page** Catalog internal systems and assess associated risks annually. This feature helps you comply with DORA’s requirements for maintaining an inventory of ICT Assets and assessing their associated risks. A decision is pending on whether to create a new UI for internal systems or update the existing Contracts page. #### Providers and Contract Management **Providers Page** Manage your Providers efficiently by adding and logging Provider information. This feature helps you comply with DORA’s requirements for managing and continuously monitoring third-party ICT service providers and ensuring that they are operationally resilient. **Contracts Page** Manage Contracts with versioning and direct linking to your ICT network. This feature allows you to establish relationships between the organization and ICT Intra-group Service Providers and Third-party ICT Providers. Services offered and Functions are documented for a deep understanding of how outsourcing impacts your digital technical operations. This not only fulfills a core requirements of DORA's Register of Information reporting but also enables continuous monitoring and real-time visibility into your ICT network. *** ### Compliance Monitoring #### **Health Page** The Health Page features 1) an Overview of your organizations' library of records, 2) an Activity dashboard across users on the app, and 3) a Readiness Score and breakdown of compliance with the DORA framework, relating back to the Policies & Controls module. This page gives an easy-to-monitor overview of the general health of your compliance with DORA. *** ### Control & Policy Management #### Policies and Controls **Document Library** Upload and manage governance documentation to track all policy and procedure documents in one place. Leverage DORAedge's proprietary control library to facilitate a streamlined control mapping process. This functionality is useful for 1) early-stage governance document writing and 2) conducting a gap analysis on existing documentation to comply with the DORA framework. *Coming soon: Document ownership and automated review cycles.* **Control Library** See all requirements suggested to fulfill regulatory compliance obligations, and, within one view, see which requirements are appropriately covered in your organization's governance documentation. *Coming soon: Tracking evidence and exporting the Control Library for offline view.* #### Risk Management **Risks Page** Identify, assess, and mitigate future risks through risk profiling and defining treatment plans. Risks can be added and edited individually as well as represented through visualizations that showcase risks in aggregate. This feature provides detailed insights into your risk landscape, helping you comply with DORA’s requirements of implementing a comprehensive ICT risk management framework with continuous monitoring and reporting of ICT risks. *** ### Incident Management #### **Incidents Tracking and Logging** The Incidents Page provides example workflows for managing major and non-major incidents. AI tooling is integrated into this feature to notify of and log Incidents, categorize criticality, and populate descriptions based upon the initial notification, and there is comprehensive field inclusion to ensure all necessary information is captured for comprehensive documentation. **Incidents Reporting** Incidents are timestamped, creating a timeline of truth, and notifications are enabled for all subsequent reporting requirements, from initial notification and filing to final report. Reports can be easily exported in the required format for submission to Competent Authorities. This aligns with DORA’s requirements for incident reporting and management, ensuring timely and accurate reporting of ICT-related incidents. *** ### Operational Tools #### Audit **Versioning** All saved changes to records are tracked for a history of changes — who, what, and when. **Archiving** Per DORA, records should be archived rather than deleted. Records can be deactivated to ensure exclusion from Register of Information reporting but will still be accessible for view within DORAedge for complete view of your ICT network. **Activity Log** Maintain a rolling log of all activities for auditing and compliance purposes. This feature ensures that you have a detailed record of all actions taken, helping you meet DORA’s requirements for traceability and accountability. *** ### User Management #### People Management **People Page** Add and delete team members, and assign baseline permissions. This feature helps you manage your team and external stakeholders effectively, ensuring that all roles and responsibilities are clearly defined and aligned with DORA’s requirements for governance and oversight. *Coming soon: Assign roles and responsibilities with the appropriate ACLs in place.* #### Profile Settings **Profile Page** The Profile Page provides basic profile settings and descriptions functionalities. *Coming soon: The user-friendly interface allows you to update profile information easily, ensuring that all user data is current and accurate, as required by DORA.* *** ### AI and Automation **DORAedge Assistant** The **DORAedge Assistant** chat feature provides a custom-trained model for contextual answers and policy reviews. This feature helps you navigate complex regulatory requirements and ensures that your policies are aligned with DORA’s standards. **Regulatory Model** Access to all guidance materials and proprietary training material ensures that you have the latest information on regulatory requirements and best practices. This feature helps you stay compliant with DORA and other relevant regulations. **AI Features** The AI features include prefilled forms for contracts, risks, and incidents, with the ability to query the model for explanations. This feature ensures that your documentation is accurate and compliant with DORA’s requirements for ICT risk management and reporting. *** ### Conclusion DORAedge is designed to simplify compliance with DORA, providing robust features and an intuitive interface. Stay tuned for future updates as we continue to enhance the platform to meet your operational resilience needs. With DORAedge, you can be confident that your organization is well-equipped to manage digital risks and maintain operational resilience in compliance with DORA. # User Guide ### Introduction Welcome to DORAedge, your comprehensive solution for ensuring compliance with the Digital Operational Resilience Act (DORA). DORAedge is designed to simplify compliance operations relating to DORA, providing you with the tools and insights necessary to track your information communication technology (ICT) network, comply with regulatory obligations, and ultimately maintain operational resilience in the face of digital risks. This guide will help you navigate through the platform’s features and functionalities, ensuring a smooth and efficient experience. # Platform Overview Understanding and navigating DORAedge ### Health Page / Dashboard This dashboard provides three key sections of information: 1. **Overview:** contains a count of the number of records tracked in the app, split by record type 2. **Activity:** shows all activity on your organization's platform, listing each user, the type of action, and a timestamp. It's possible to click directly into the record that has been created, updated or deactivated. 3. **DORA Compliance and Control Summary:** 1. The Compliance Readiness score highlights a percentage of completion, indicating the proportion of Articles (control requirements) in the DORA regulatory framework that have a Policy (governance) document assigned to them in the **Policies & Controls** module, which considers them to be "done". As more requirements are *satisfied* by Policy documents, this percentage will increase. 2. The Control Summary breaks down the score by the number of requirements in DORAedge per Pillar in the regulation that are satisfied by a Policy document. *** ### Get Started Think of DORAedge not just as a platform for filling in form, but for structuring your organization's information communication technology (ICT) network and operations. Structuring this accurately will enable your internal, cross-functional DORA team and external advisors to appropriately assess and manage your resilience and mitigate potential risks. *** ### ICT Network Setup You may follow this as a suggested checklist or order for setting up your organization's DORAedge account. While the **Policy & Controls** module can be leveraged concurrently to build out governance, we recommend the following order for setting up your ICT network: 1. **Entities** 2. **Branches** (if applicable) 3. **Functions** 4. **ICT Assets** 5. **Providers** 6. **Contracts** \*Since records are well linked within DORAedge, setting up these will enable a more streamlined adding of **Risks** and **Incidents** at later stages. It is highly encouraged that the first three in the list above are built out first. *** #### Familiarize yourself with DORA's terminology Consider the following: 1. **Entity** — who we are (as an organization, and potentially within a group structure) 2. **Branch** — a local office or operational presence of an entity that operates under the license and oversight of a parent entity in another jurisdiction 3. **Function** — what we do / the licensed activity we execute (what we deliver to clients) 4. **Provider** — what third-parties help us execute our **Functions** 5. **Contract** — a formal arrangements between a **Provider** (ICT third-party or Intra-group) and an **Entity** or **Branch** (or multiple) 6. **ICT Asset** — technology/system managed internally 7. **Risk —** what could go wrong that needs to be tracked so that it can be mitigated 8. **Incident** — a categorized ICT disruption or outage, cyber threat 9. **Policy** — a governance document that is written to satisfy a set of controls in the regulation 10. **Control** — a requirement that an entity must satisfy in order to fulfill their obligation stated by an Article in the regulatory framework 11. **Register of Information** — an obligatory regulatory report that documents an entity or group's ICT network with linking and dependencies in a standard format *** #### **In practice** To get comfortable with using DORAedge, try selecting one **Entity**, and build out all of its **Functions** (and **Branches**, if applicable). Then choose a third-party ICT **Provider** to map out against the **Functions** in a **Contract.** This should help with building out the flow and replicating it. # ICT Network The ICT Network includes Entities, Branches, Functions, Providers, ICT Assets, and Contracts. Detailed information on Contracts can be found in Contract Management. ## Record Management ### Adding a New Record You can **manually create** a new record in DORAedge by selecting **+ Add \[Record Type]** from the table view of the record type. To save a record successfully, all required fields must be completed with valid information. If a required field is missing or contains invalid data, it is highlighted in red and an error message is displayed. These issues must be resolved before the record can be saved. {% hint style="info" %} **Contracts** are the only record type that can be added to DORAedge via import. See [Importing Contract Records](/user-guide/contract-record-management#importing-new-contract-records). {% endhint %} *** ### Editing a Record You can update existing records in two ways: * From the **table view**: Click the three-dot menu in the far-right column of the record row and select **Update**. * From the **record view**: Click the three-dot menu in the top-right corner of the card and click **Update**. {% hint style="info" %} When you submit updates to a record, the system saves the record as a **new version**. Click Versions in the record card to see a log of all changes made to the record since initial creation. {% endhint %} *** ### Record Statuses * Upon creation, records are saved as **Active**. * To **Archive** a record, click on the Record in the table, from the three dots on the top right of the screen, click Archive. * **Archived Status:** the record will be excluded in the Register of Information report. * To **Restore** records that are **Archived,** click on the record, and click on the Archived button on the top right of the screen. * Restoring records makes them **Active** and can then be included in the Register of Information report. *** ### Exporting Records All ICT Network records (Entities, Branches, Functions, Providers, ICT Assets, and Contracts) can be exported from DORAedge into an .xlsx file. Exports provide an offline view of network data and include: * All form fields, including those required for Register of Information reporting. * System data such as internal IDs, creation dates, and the user who created the record. Before exporting, choose whether to export **all network records** or a **specific subset of records**. #### Export All Network Data Use this option to export every ICT Network record into a single file. To export all Network Data: 1. In the sidebar, go to the Network section, then click **Network** **Data**. 2. Click **Export All Records**, and review [Export Options](#export-options) to configure which records and data levels to include in the export using toggles. 3. Click **Export All Records** again to generate the .xlsx file. #### Export Selected Records Use this option to export specific record types or individual records. To export selected records: 1. In the sidebar, go to the Network section, then click **Data**. 2. Click **Select Records Manually**. 3. In the Record Types sidebar, select either 1. Entire record types (for example, Entities), or 2. Individual records within a record type. 4. Repeat the selection for each required record type. 5. Review [Export Options](#export-options) to configure which records and data levels to include in the export using toggles. #### Export Options Export Options control which records and which level of detail are included in the exported file. * **Archived Records**: Archived ICT Network records are excluded from Register of Information reporting, unless this setting is toggled on. * **Contract Drafts**: Contract records that are partially completed are excluded from the Register of Information, unless this setting is toggled on. * **Complete Contract Details**: By default, Network Data exports include limited Contract details. Enable this option to include all Contract fields. #### Export Limitations {% hint style="warning" %} Network Data exports are provided for offline review purposes and should **not** be used for regulatory reporting. {% endhint %} Network Data exports **cannot** be used to import or update Contract records in DORAedge. To add new and/or modify existing Contracts in bulk, download editable spreadsheets from the Contracts page. See more information in [Contract Record Management](/user-guide/contract-record-management). # Contract Record Management Specific to creating, maintaining, importing, and exporting Contract records. ## Record Management Contracts can be generated manually by entering Contract details in the form, or by completing and importing a DORAedge-specific template that includes Contract information. *** ### Adding a New Record You can **manually create** a new record in DORAedge by selecting **+ Add \[Record Type]** on the table view of that record type. To successfully save a record, all required fields must be completed with valid information. If a required field is incomplete or contains invalid data, it will be highlighted in red with an error message. These must be corrected before you can proceed and save the record. *** ### Editing a Record You can update existing records in two ways: * From the **table view**: Click the three-dot menu in the far-right column of the record row and click Update. * From the **record view**: Click the three-dot menu in the top-right corner of the card and click Update. *** ### Importing New Contract Records Contract records can also be created in DORAedge via **import.** This feature allows you to upload multiple **new** Contract records at once using a specific spreadsheet template. For importing **updates to existing** Contracts, see [Importing Updates to Existing Contracts](#importing-updates-to-existing-contract-records) below. {% stepper %} {% step %} #### Starting the Import Process 1. Go to the Contract page under the Network data section of the sidebar. 2. Click **Add Contract**, then **Import from File**. 3. In the dialog box, **download the DORAedge tenant-specific spreadsheet template**. Use this template to populate Contract data outside of DORAedge. {% hint style="info" %} This template is used exclusively for importing Contract records that **do not already exist** in DORAedge. {% endhint %} {% endstep %} {% step %} #### Populating the Import Spreadsheet (Offline) 1. Add Contract data starting from Column B, Row 5 by following the instructions provided in Rows 3 and 4 of each sheet in the workbook. 2. Any records (Entities, Branches, Functions, and Providers) referenced in the spreadsheet **must already exist in DORAedge**. 3. To successfully import a new, unique Contract record: * Each sheet must contain at least one row per Contract Reference Number. * If a Contract has multiple Relationships or Signatories, reuse the same Contract Reference Number in additional rows as needed. * Each unique Contract must meet all data validation rules before import. {% endstep %} {% step %} #### Understanding the Spreadsheet Contents The downloaded spreadsheet contains two key sheets to help you enter valid data: * **DORAedge Data**: A reference list of all Entities, Branches, Functions, and Providers already in your organization’s DORAedge account. Select the relevant records from the dropdown menus in the applicable columns. * **EBA Code References**: A list of predefined Register of Information options from the EBA. Select the relevant options from the dropdown menus in the applicable columns. {% endstep %} {% step %} #### Saving the Spreadsheet and Importing it into DORAedge Before uploading your completed spreadsheet, make sure it meets the following requirements: * **File format:** The file must be saved in **.xlsx format**. * **Name**: You can use any name. There is no required naming convention for a successful import. * **Size**: The file must be **smaller than 24 MB**. {% endstep %} {% step %} #### Validating Imported Contract Data When importing Contract records, DORAedge guides you through validation in the import wizard: * **Invalid records**: In the Validate Data step, DORAedge displays all data from your import spreadsheet and flags any errors by sheet. Each issue includes the Cell with Error and an Error Description. Use this information to correct the errors in your spreadsheet, save a new version of the file, and re-upload it. * **Valid records**: If all data passes validation, the Review & Confirm step appears. Review the data in each tab to ensure everything is accurate before finalizing the import. {% endstep %} {% step %} #### Reviewing Imported Contract Data Once imported, each Contract record is assigned a **Record Source** in the Details section of the Contract card, indicating whether it was Manually Added or Imported. You can also filter the Contracts table by Record Source to quickly view and manage records based on how they were created. {% endstep %} {% endstepper %} {% hint style="warning" %} Having trouble successfully importing new Contract records via the import spreadsheet and new functionality in DORAedge? Please email **** for assistance from the DORAedge team. {% endhint %} *** ### Exporting Existing Contract Records Existing Contract records can be exported from DORAedge into an Excel file that contains a separate sheet for each step of the Contracts flow. This export uses a DORAedge-compatible .xlsx template that can be reused to: * Import new Contract records * Update existing Contract records To export existing Contracts: 1. From the Contracts table, select: 1. Specific Contracts by selecting individual checkboxes, or 2. All Contracts by selecting the checkbox in the table header. 2. Click **Export** to download the .xlsx file. *** ### Importing Updates to Existing Contract Records To import bulk updates to existing contracts, 1. Follow all steps in [Exporting Existing Contracts Records](#exporting-existing-contract-records) above, and 2. Follow steps 2-6 in [Importing New Contract Records](#importing-new-contract-records). # Contract Setup # Register of Information Generate the Register of Information for regulatory reporting. DORAedge enables regulated financial entities to easily generate the Register of Information (RoI) report from ICT Network data. The report can be extracted ad-hoc as needed and to comply with annual regulatory reporting requirements. ### Specifications of the Register of Information * **Format:** xBRL-CSV reporting package, zip file with all required sheets and metadata. * **Data:** Includes all ICT Network and contractual relationship data required for reporting in alignment with the European Banking Authority (EBA) Data Model (DPM) 4.0. ### Generating the Register of Information Prior to generating the Register of Information, ensure that all ICT Network data (Entities, Branches, Functions, Providers, and Contracts) is accurate. {% hint style="warning" %} Any Archived records or Draft Contracts will **not** be included in the Register of Information. Expired Contracts will be included, unless those records are Archived. {% endhint %} To create a Register of Information report: 1. In the sidebar, go to the Export section, then click **Register of Information**. 2. Select the **Subject Entity**. 3. Select the **Reporting level**. 1. **Individual consolidation:** All non-draft and non-archived Contacts with the Subject Entity identified as the Consumer Entity will be included. 2. **Sub-consolidated:** All non-draft and non-archived Contacts with the Subject Entity and child Entities identified as the Consumer Entity will be included. 3. **Consolidated:** All non-draft and non-archived Contacts for all Entities identified as the Consumer Entity will be included. 4. **Custom:** Select specific Entities from the Group to be included. 4. Choose the **Reference Date**. 1. For annual reporting requirements, select the date instructed by regulators. 5. Choose the **Reporting Standard.** 1. As of April 2026, DORAedge offers four (4) Reporting Standards can be selected when generating the Register of Information, where each standard has its own custom fields and file package requirements in relation to the corresponding Competent Authority. 1. **EBA Standard** 1. This is the EBA's Reporting Standard and is the base Standard for all Register of Information reports. Enabling **Use Custom Report File Settings** allows you to modify the Reporting ID and Reporting Package File Name when generating the reporting package. 2. **NBB-, AFM-, and CAA-specific Standards** 1. These Standards specific to each corresponding Competent Authority with unique custom fields and file package requirements. Select one of these Standards if in need to generate a Register of Information for the applicable Competent Authority. 6. Enable or **Skip validations.** 1. If this box **is not selected**, data validations will run prior to the Register of Information being created to ensure that all data fits reporting requirements. 1. If the Invalid Register of Information error message pops up, click **View** on the individual records that have errors. Click **Edit \[Record]** to correct invalid data on the record. 2. Once all data errors are corrected, click **Create** to generate the Register of Information. 2. If this box **is selected**, the Register of Information will be generated, regardless of any data errors. 7. Click on **Create Report** to export the Register of Information out of DORAedge. {% hint style="warning" %} Once the Register of Information is exported, **do not make any changes to the file**, including the name of the folder, sheets or any data. Doing so can cause invalid report submissions to regulators. {% endhint %} # Incident Management Logging and reporting ICT-related incidents ### Logging an Incident & Creating Reports Per DORA's technical standards, three reports must be submitted for **major ICT-related incidents.** {% stepper %} {% step %} #### **Adding an Incident** This will log the Incident in DORAedge so that the reports can start to be created. Whether the Incident is classified as **major** or **non-major** is determined by answering the questions in the Criticality step. * *After saving the Incident, the classification can be updated with a reason on the Incident's page by clicking on the classification.* {% endstep %} {% step %} #### **Report 1: Initial notification** Where applicable, details submitted when adding the Incident are pre-filled in the Initial Notification report. {% endstep %} {% step %} #### **Report 2: Intermediate** Where applicable, details from the Initial Notification are pre-filled in the Intermediate report. {% endstep %} {% step %} #### Report 3: Final Where applicable, details from the prior reports (Initial notification and Intermediate) are pre-filled in the final report. {% endstep %} {% endstepper %} *** ### Reporting Time Limits DORA requires financial entities to submit Incident reports for ICT-related incidents that are categorized as major. * **Major** incidents: the time limits for reporting are automatically set to mirror the technical standards for reporting major ICT-related incidents to Competent Authorities. * Please note that Incident reports created in DORAedge must be **exported and submitted** to Competent Authorities per their specific submission guidelines within the time limit requirement. * **Non-major** incidents: As of April 2026, DORAedge has not yet implemented suggested discretionary time limits, as non-major reports are not required to be reported to Competent Authorities/EBA. *** ### Activity Timeline DORAedge captures both system-generated and user-logged information related to the Incident. * **System generated**: triggered upon logging incidents as well as creating and updating reports * **User-logged**: internal, freeform comments can be left in the Status Updates field * This can be used for tracking offline incident activity, e.g., sending reports outside of DORAedge and submitting them to Competent Authorities *** ### Exporting Reports After a report is created, click **Open** to see the report details in a slide out. Click **Export Report**, and select the desired file format for the exported report per your Competent Authority's requirements. # User Access Types & Permissions Breakdown of "what users can do" across DORAedge ### Access Types When both creating the DORAedge tenant for your organization and adding new users to the workspace, an Access type is assigned to each user. Access type assignments determine what permissions users have across the app. #### Available Access Types * **Owner:** The user who created the DORAedge workspace, and they have full access to records across the app. The Owner is the only workspace user who has access to the **Billing** page, which is accessible by clicking on their name on the bottom left of the side bar. * **Administrator:** Full access with the ability to create, update, and archive all records. * **Editor:** Full access with the ability to create, update, and archive all records. * **Viewer:** View only access to all records. *** ### Permissions across DORAedge The table below outlines the various record types and permissions available by user access type. **Legend:** * **Manage**: Can Create, Update, and Archive all records * **Read only**: Can only view all records
Record TypesOwnerAdminEditorViewer
ICT Network: EntitiesManage allManage allManage allRead only
ICT Network: BranchesManage allManage allManage allRead only
ICT Network: FunctionsManage allManage allManage allRead only
ICT Network: ProvidersManage allManage allManage allRead only
ICT Network: ICT AssetsManage allManage allManage allRead only
ICT Network: ContractsManage allManage allManage allRead only
Compliance: Policies & ControlsManage allManage allManage allRead only
Compliance: RisksManage allManage allManage allRead only
Compliance: IncidentsManage allManage allManage allRead only
Export: Register of InformationManage allManage allManage allCan only download previously generated reports
Export: Network DataManage allManage allManage allRead only
Team: User ProfilesSee belowSee belowSee belowSee below
*** ### Teams Page An overview of assigned Access types across your organization's workspace is viewable on the **Teams page**. #### Access Type Assignments & Permissions The table below outlines permissions related to user accounts and profile information. **Summary:** * **Owner:** Highest level of access. Full control over user profile information. * **Administrator:** Can manage users and edit most profile information. * **Editor:** Read-only access to other users’ details. Can update their own profile information. * **Viewer:** Read-only access to other users’ details. Can update their own profile information. **Legend:** * ✅: Has permission * ❌: Does not have permission * 🔒: Not applicable
PermissionOwnerAdminEditorViewer
Edit own name✅✅✅✅
Edit own email address*🔒🔒🔒🔒
Edit own phone number✅✅✅✅
Edit own job title✅✅✅✅
Change own access type❌❌❌❌
Edit another user’s name❌❌❌❌
Edit another user’s email address*🔒🔒🔒🔒
Edit another user’s phone number✅✅❌❌
Edit another user’s job title✅✅❌❌
Change another user’s access type✅ **✅❌❌
Invite users to the team (via email)✅✅❌❌
Resend invite✅✅❌❌
Remove users from the team✅✅❌❌
**Notes:** \*Email Address cannot be changed after workspace creation or invitation. \*\*Owner Access type is established upon DORAedge tenant creation and cannot currently be transferred to other users in the workspace. # Compliance Tasks ### About **Compliance Tasks Table** The Compliance Task Table helps users monitor records across DORAedge that may require attention based on review dates, reporting requirements, and upcoming deadlines. The Compliance Tasks table is available on the Dashboard Health page and provides a centralized view of: * Upcoming review activities * Overdue compliance actions * Incident Reports requiring completion * Contracts approaching their End Date * ICT Assets approaching their Decommissioning Date * Contract Data Issues caused by archived linked records ### **Accessing the Compliance Tasks Table** To find the Compliance Tasks table: 1. Log in to DORAedge. 2. In the sidebar, select **Health**. 3. On the Health page, look for the **Compliance Tasks** table next to the **Compliance Overview** section. ### **Understanding Compliance Tasks** Each Compliance Task displays: * `{Record Type} · {Record Name}` * A task description explaining the required action * `{x}d overdue` or `{x}d left` The Compliance Tasks table supports: * Policies * Risks * Incident Reports * ICT Assets * Contracts The Compliance Tasks table may also include Data Issues for Contracts with links to archived records. ### **Filtering Compliance Tasks** The Compliance Tasks table supports filtering using: * **All** — all active tasks * **Overdue** — tasks past the relevant date * **Urgent** — tasks due within 30 days * **Upcoming** — tasks due within 60 days * **Data Issues** — tasks related to Contracts that are linked to archived records #### **Record type filter** Use the Record Type dropdown to filter tasks by: * Policies * Risks * Incident Reports * ICT Assets * Contracts The filter pill counts automatically update based on the selected Record Type. ### **Resolving Compliance Tasks** Most Compliance Tasks are resolved by reviewing the related record, then manually marking the task as completed. The exception is Incident Reports, which are resolved by submitting the form. After the action is finished, the task is automatically removed from the Compliance Tasks table. #### **Policies & Risks** Policy and Risk tasks are generated based on review schedules. To resolve the task: 1. Open the related record. 2. Carry out the review activity. 3. Save any changes. 4. Mark the task as completed. When you finish a review, DORAedge automatically updates: * Last Review Date * Next Review Date Record Version History also reflects the review activity. A new Compliance Task will appear again when the next review date approaches. #### **Incident Reports** Incident Report tasks remain active while reports are saved as **Drafts**. To clear the task: 1. Open the Incident record. 2. Complete the required Incident Report form. Once completed, the task is automatically marked as complete and removed from the Compliance Tasks table. #### **ICT Assets** ICT Asset tasks appear when assets approach their Decommissioning Date. To resolve the task: 1. Open the ICT Asset record. 2. Review and update the ICT Asset as required. 3. Save the updated record. 4. Manually mark the task as complete. #### **Contracts** Contract tasks appear when Contracts approach their End Date. To resolve the task: 1. Open the Contract record. 2. Review and determine whether to let the contract be terminated, update it, or renew it if it has already expired. 3. Save any changes. 4. Manually mark the task as complete. **Data Issues** Data Issues appear when a Contract contains archived linked records, including: * Relationships * Assessments * Supply Chains * Signatories To resolve a Data Issue: 1. Open the Contract record. 2. Review the archived linked record identified in the task. 3. Either: * Restore the archived record, or * Update the Contract by replacing it with an active record, then save the changes. Once resolved, the Data Issue is automatically removed from the Compliance Tasks table. ### Finding Compliance Tasks in Records Compliance Tasks can be accessed from both the Compliance Tasks table and the related record. * For Risks, Incident Reports, ICT Assets, and Contracts, date-based Compliance Tasks are displayed as a notification banner on the record details page. * For Policies, review tasks are displayed as an alert within the document drawer. * Selecting a task from the Compliance Tasks table opens the associated record so the required action can be completed. ### **Compliance Overview** The Compliance Overview section displays the organization’s DORA compliance readiness. As of May 2026, the previous progress bar has been replaced with a donut chart showing: * Percentage of completed controls * Number of controls completed * Number of controls not started ### **Additional Notes** * Compliance Tasks are automatically generated based on record dates and workflows. * Tasks remain visible until the required action is finished. * Data Issues are automatically resolved when archived linked records are restored or replaced with active records. * Compliance Tasks may also be viewed directly from the associated record. # Help & Support Inquiring about and seeking support with DORAedge ### In-App Inquiry Capture As of April 2026, DORAedge has an in-app feature called **Help & Support** that is accessible from the app sidebar. Use this to request both product/technical and contract/billing support. #### Help & Support Feature * **First-line support:** * **AI Chat Assistant** - click "Chat with Assistant" * Start a conversation with DORAedge's proprietary Chat Assistant to help with questions regarding the DORA regulation, how to use DORAedge, and data related to your DORAedge workspace * The AI feature is trained on the DORA regulation including the directive, technical standards, and data in your organization's DORAedge workspace **only**. The AI Assistant should not be considered as an expert in the DORA regulation, rather can be used as a guide. * **User Documentation** - click "View Documentation" * Reference DORAedge's user documentation for more information on the platform. The User Guide provides instructions on how to use features across the app and key considerations to keep in mind when doing so. * **Second-line of support** * **Contact the DORAedge support team** - click "Submit Support Request" * If additional support is needed beyond the AI Chat Assistant and User Documentation, choose one of the three options below and complete the short form to submit a support request directly to the DORAedge support team: * Ask Question * Report Problem * Request Feature * It's possible to upload attachments with your request as context or evidence between the request and to help resolve any outstanding issues. * After reviewing your inquiry, the DORAedge team will respond to your request as soon as possible via an email from the address: **.** # Release Notes ### Summary This section highlights planned enhancements and developments to the DORAeddge platform. All new features, fixes, and updates will be documented on a \~monthly/ bi-monthly cadence in its own page so that platform users are aware of and can look back on previous updates. When a new Release takes place, the DORAedge team will email users a direct link to the Release Notes page. # 1 June 2026 ## **Released June 2026** #### **Summary** This release introduces a new Compliance Dashboard experience designed to help teams stay on top of important review dates, follow-up actions, and ongoing compliance activities across DORAedge. Key improvements include centralized task tracking, better visibility into upcoming deadlines and overdue actions, and improved visibility into records that require updates. ### **What's New** #### **New Compliance Tasks Table** * Added a new Compliance Tasks table to the Dashboard Health page. This helps users quickly identify records that may require attention based on important dates and review requirements. * The Compliance Tasks table supports: * Policies * Risks * Incident Reports * ICT Assets * Contracts * Compliance Tasks are also visible within the relevant records. * Date-based tasks appear as a notification banner on the record details page. * Policy review tasks appear as an alert in the Policy document drawer. * A new **Data Issues** task category helps identify Contracts that contain archived linked records. * Contracts linked to archived records are flagged under the Data Issues category. This includes archived records linked in Relationships, Assessments, Supply Chains, and Signatories. #### **Improved Tracking & Visibility** * Compliance Task names and descriptions now provide better context on actions that may be needed. * Tasks now clearly indicate whether an item is upcoming or overdue. * New filtering options make it easier to focus on specific record types and identify outstanding items quickly. * Replaced the Compliance Overview progress bar with a donut chart for a clearer overview of compliance progress. ### **Automated Reviews** #### **Policies and Risks** * Completing a review for a Policy or Risk now automatically updates: * the **Last Review Date**, and * the **Next Review Date** for the following review cycle. * Record Version History now reflects completed review activity to help maintain an audit trail of record updates. #### **Incident Reports** * Completing and submitting an Incident Report now automatically marks the related Compliance Task as complete. * Incident Reports saved as Drafts will continue appearing in the Compliance Tasks table until they are fully completed. #### **ICT Assets & Contracts** * ICT Assets approaching their Decommissioning Date can now appear as Compliance Tasks to help teams monitor assets nearing end-of-use. * Contracts approaching their End Date can also appear as Compliance Tasks to support renewal, updating, or archiving activities. * Once the required action is completed, these tasks are automatically removed from the Compliance Tasks table. If a future date is added or updated, the task will reappear when it falls within the relevant tracking period. #### **Data Issues** * Data Issues are automatically resolved when the archived record is restored or replaced with an active record in the Contract. # 20 April 2026 ## Released 20 April 2026 #### Register of Information * **New Competent Authority-specific Reporting Standards:** When generating a Register of Information, it is now possible to select a Reporting Standard that deviates from the EBA Standard, which is the base Standard for all reports. * This release included specific reporting Standards in alignment with the following Competent Authorities: * CAA (Luxembourg) * NBB (Belgium) * AFM (Netherlands) #### Help & Support * **New Help & Support Feature:** A new Help & Support workflow is accessible via the sidebar to have quick questions answered and to request support from the DORAedge team. * Users can chat with the AI Assistant or view [DORAedge User Documentation](https://docs.doraedge.com). * The sidebar also includes a direct link to [Release Notes](/release-notes) to see the latest developments in DORAedge. #### Teams Page * **Enhanced User Functionality on Teams Page:** Users have expanded functionality to update their own profile details, including First and Last Name, Phone Number, and Job Title). Owners and Admins can update team members' Access Types and selected profile details based upon their permissions. # 6 February 2026 ## Released 6 February 2026 ### Summary This month's product updates were focused on strengthening day-to-day compliance operations: helping teams maintain accurate, auditable ICT network data over time and stay confident in Register of Information (RoI) reporting, even as underlying records change. #### Register of Information * **Archived Records:** The logic for Register of Information reports has been updated so that **all records that are archived will not appear on the Register of Information report.** If a record needs to appear on the report, Restore the record from its card. * **Informational Text:** * **Page Rename:** This page is renamed to **Register of Information** from Reports. The table showing previously generated Register of Information reports is now called **Export History**, consistent with the Network Data page. * **Validation Error Messages:** Error messages in the Register of Information validation step now clearly identify if a record is invalid due to an Archived linked record, for ease of correcting the error before generating the Register of Information. #### Archived Records * **Display:** Archived records now show "(Archived)" after the record name across Linked Records (e.g., an archived Provider will be labelled as such on a Contract) * **Behavior:** * When creating a **new** record, Archived records will not appear in dropdown lists for selection. * In an **existing** record, it's possible to Update the record to replace Archived linked records with Active records. In the dropdown list, the previously selected record will show as being Archived, will not be selectable, and it will be required to select a new, Active record to save the record as a new version. #### Contracts **Relationships - Data Storage & Processing:** * In the Contract form, it's now possible to identify more than one country for Data Storage and Data Processing, which prompts new fields to appear and be filled out. * The selected countries for these fields now show in the table on the Relationships screen. * When Duplicating a Relationship, this now appears as a slide out form instead of the previous pop up window. **Linked Records - Status** * In Linked Records (the section on Entity, Branch, Function or Provider records), the Contract's status is now visible in collapsed view. This status is related to whether the Contract is Ongoing or Expired, based upon the Contract End Date. **Contract Status** * The Contract Status **Ongoing** was updated from its previous name, Active. * When hovering over the **Status** column in the Contracts overview table, a tooltip now appears to indicate that: * This designation (Ongoing or Expired) is based off of the Contract End Date, and * Expired Contracts are automatically included in the Register of Information and are only excluded if their records are manually Archived. #### Providers * **Overview page:** Providers can now be searched and filtered on both by their Standard and Legal Names #### Record Version History * **User Name:** On a record's Versions tab, the name of the user who affected changes to the record now appears. #### Sidebar * **Page Spacing:** The sidebar is now denser so that all pages in the list are visible on short browser windows. # 19 December 2025 ## Released 19 December 2025 ### Summary Rounding out new record import and export developments, three new, value-added features are included in this release. These should continue to foster and enhance data transparency, collaboration, and auditing of records related to the Register of Information. #### Contracts **Export existing Contracts** * All or selected Contract records can be exported into a spreadsheet from the table on the Contracts page **Import bulk updates to existing Contracts** * The exported spreadsheet containing existing Contract record details from the step above can be updated offline and re-imported to update existing and adding new Contract records * This process follows the same flow as importing the Contract spreadsheet to add new Contract records, and * The Review step in the flow shows which fields will be changed to what new value #### **Network Data** **Export Network records (Entities, Branches, Function, Providers, ICT Assets, and Contracts)** * It's now possible to export all ICT Network records * All or selected records can be exported from the new Data page (under the Network section) * **Export options** can be toggled on and off to set specific preferences * Archived records can be included * Contract Drafts can be included * Contract exports can include basic details or complete record information * All exported records will include system data (e.g., Date of Record Creation and Record Creator) * An Export History table will show a log of all record exports generated # 10 October 2025 ## Released 10 October 2025 ### Summary Kicking off a series of data-focused new product developments within the DORAedge platform, we released the first functionality to **import records** (as an alternative to manually adding them through the forms). #### What's new **New Contract records can now be added to DORAedge via import.** * Download a DORAedge-tenant specific spreadsheet template for populating Contact information offline. The spreadsheet: * Enables bulk (more than one) upload of new Contract records. * Contains existing tenant-specific records (lists of Entities, Branches, Functions, and Providers) that are sourced directly from DORAedge into the spreadsheet and are options to select via dropdown lists in relevant columns/fields. * In the import wizard, the Validate Data step reflects all data from the import spreadsheet and identifies any and all errors related to data entry. Users can follow this to correct errors in the import spreadsheet, save a new version, and re-upload if needed. * Contract records now have a **Record Source** assignment (shown on the Contract card in the Details section)**,** either Manually Added or Imported. In the Contracts table, the list can be filtered on this field. **Important notes:** * Import spreadsheet * Any records (Entities, Branches, Functions, and Providers) linked need to already exist in DORAedge. The spreadsheet import template accessible for this release is for Contract records only. * Every Contract listed in the import spreadsheet needs to satisfy all data validation rules in order to be uploaded successfully. * To represent multiple Relationships or Signatories within a Contract, the Contract Reference Number should be copied into new rows as needed. * Step-by-step instructions for Importing Contracts are on the [ICT Network](https://docs.doraedge.com/user-guide/ict-network) page of the User Guide. Why bulk import? The EBA Register of Information template is complex to interpret and understand, resulting in data errors and excessive time loss to prepare. We built this functionality to: * Harmonize the EBA template with the Contract form in DORAedge, reducing redundant reference fields and streamlining data collection. * Increase data (ICT network) comprehension and legibility by allowing list names rather than EBA code. * Speed up data gathering in DORAedge through single-action bulk upload vs. single record data entry. * Create efficiency and transparency around collating Contract details for the Register of Information across organizations. #### **What's to come** * Downloadable error spreadsheet * Users will be able to download a full data import error list to review and share outside of the DORAedge platform. * Using the import functionality to **edit existing** records (not just create New) * Users will be able to write over existing record versions to update information. The same bulk import record functionality will exist. * Extending the import functionality to other record types * Users will be able to import records other than Contracts (Entities, Branches, Functions, and Providers). * Saving import sessions/invalid records as a draft * Users will be able to return to the record errors from import at a later time to rectify them and save valid records. # 5 August 2025 ## Released 5 August 2025 ### Summary This release includes a couple new features to improve continuous ICT-network monitoring, compliance operations and incident reporting requirements. #### Incidents 1. Rolled out "relaxed" reporting time limits for Incidents categorized as "Non-major." 2. Description allows for "returning" for paragraph formatting. #### **Contracts** 1. Introduced Contract "Statuses" 1. **Active** and **Expired** statuses are automatically assigned based upon the **Contract End Date.** 2. Contracts can now be **Archived** and **Restored** for the purposes of including or excluding them from the Register of Information report. Archived Contracts require inputting a reason. 3. Added a **Renew** Contract feature on Expired Contracts which creates a Draft Contract that maintains all Contract details. 2. Navigation / Usability 1. Updated the Relationship duplication feature to include a shortcut for "Service Type." 2. Separated pages for Draft and Archived Contracts. 3. Added filtering of Contracts in table lists by Status and End Date. 4. Parent contracts are now linked and accessible via associated Contract records. 5. Validation in Contract form to ensure that all Contracts have unique Reference Numbers. #### **General Form updates** 1. "Save without changes" and "Exit" buttons on all forms 1. Forms show an “Exit” button when a record is both created, and a previously saved version is edited. “Save without changes” appears in the final step to close the form when no edits were made. 2. *Exceptions: Contract forms and Incident Reports have "Exit and Save Drafts."* 2. Linked Records 1. Show only Active data (e.g., draft Contracts are not displayed). 2. Include related Incidents on Provider cards. # 1 July 2025 ## Released 1 July 2025 ### Summary This release encapsulates improvements around data entry, searchability, and connectivity. We focused on small, impactful wins to increase utility and improve the user's day-to-day experience working in the app. #### Data Functionality 1. Increased form validation feedback 1. Ensure that fields are responsive in real time to minimize errors and confusion during data entry and form submission 2. Added search and filtering capabilities on record list tables 1. E.g., it's now possible to search for specific criteria on the Providers table 2. Intend to expand possible filtering criteria in the future based upon user feedback 3. Added search for specific Articles in the Policies & Controls module #### **Usability** 1. Enabled creating a Contract as a draft 1. It's now possible to create a Draft ("V0") Contract 2. Intend to enable saving Contract drafts (+V1) in the future 2. Updated Contract form flow and design 1. Ensure streamlined data entry and increased accuracy 3. Streamlined flow of and copy within the Incident Final Report #### **Data Contextualization** 1. Linked critical data in record list tables 1. E.g., tagged Functions and Risks are indicated in a Provider list table 2. Linked related records in record overview pages 1. E.g., without needing to click into a Contract, see the Entities and Functions the Provider serves, as well as any Risks logged related to a Provider, directly from a Provider overview page #### App Look and Feel 1. Enhanced data visibility and consistency across forms 1. E.g., extended the width of dropdown fields so that all text is visible, harmonized action buttons and error messages 2. Display made sleeker 1. E.g., gave the sidebar a new design and improved the display of breadcrumbs, moved the User information to the bottom left of the app # Regulatory Overview With direct references to DORA's regulatory texts, this section outlines how DORAedge's features support compliance within each chapter to simplify your organization's path to regulatory compliance. Welcome to the Regulatory Overview — a comprehensive resource designed to help financial entities navigate the complex regulatory landscape. This page serves as a centralized repository of essential legal texts and regulatory requirements, covering everything from digital operational resilience to ICT risk management. Whether you are a DORAedge customer or part of the broader financial ecosystem, this overview provides key insights and guidelines to ensure compliance with the latest regulations. Stay informed, stay compliant, and strengthen your organization's risk posture by using this dynamic resource. # Chapter I: Scope & Descoping (Articles 1-4) How DORAedge enables compliance with DORA ### Introduction Chapter I of DORA lays the groundwork for the digital operational resilience standards that financial entities must meet under this regulation. It introduces the overall goals, scope, and key definitions, ensuring that all financial institutions—regardless of size—are equipped to maintain secure and resilient operations. Below is a breakdown of how DORAedge supports financial entities in adhering to these fundamental provisions. *** #### **Article 1: Subject Matter** DORAedge is designed to help financial entities meet the new standardized requirements for digital operational resilience. By providing a centralized platform for ICT risk management, incident reporting, and third-party risk oversight, DORAedge simplifies compliance with key regulatory provisions. The platform ensures that financial entities maintain effective governance while streamlining operational processes and improving transparency. **How DORAedge Assists:** * Comprehensive ICT risk management and reporting tools. * Support for incident reporting and digital resilience testing. * Centralized management of ICT third-party service providers and contracts. *** #### **Article 2: Scope** DORAedge is built to accommodate the operations of a diverse range of financial entities, from credit institutions to crypto-asset service providers. The platform adapts to each entity's unique compliance requirements, helping organizations across the financial sector maintain operational integrity and digital resilience. **Entities DORAedge Can Support:** * Credit institutions * Payment institutions * Account information service providers * Electronic money institutions * Investment firms * Crypto-asset service providers * Central securities depositories * Central counterparties * Trading venues * Trade repositories * Alternative investment fund managers * Management companies * Data reporting service providers * Insurance and reinsurance undertakings * Insurance intermediaries and ancillary insurance intermediaries * Institutions for occupational retirement provision * Credit rating agencies * Crowdfunding service providers * Securitization repositories * ICT third-party service providers **How DORAedge Assists:** * A flexible architecture that supports a wide variety of financial entities. * Scalable features tailored to the specific needs of different business models. *** #### **Article 3: Definitions** *No applicable DORAedge assistance required.* *** #### **Article 4: Proportionality Principle** DORAedge ensures that its tools are scalable and adaptable to the size, risk profile, and complexity of each regulated financial entity. The platform supports proportional implementation of ICT risk management and compliance measures, offering tailored solutions that meet the specific needs of every entity, from small firms to large financial institutions. **How DORAedge Assists:** * Scalable features that adjust to the size and risk profile of the financial entity. * Tools that match the complexity and scope of each organization’s operations. * A dedicated tier for microenterprises, offering simplified controls and reduced overhead, all at a lower cost. # Chapter II: ICT Risk Management (Articles 5-16) Streamline your ICT risk management and compliance operations through DORAedge by easily implementing a comprehensive ICT governance and control framework. DORAedge helps financial entities meet their regulatory compliance obligations, from defining roles and responsibilities to tracking ICT risks, response plans, and business continuity policies. With built-in features for monitoring, documenting, and auditing your ICT risk management framework, DORAedge ensures compliance with both regulatory requirements and internal governance practices. References to the legal text are seamlessly integrated, alongside relevant system features, to help you stay aligned with the highest standards of digital operational resilience. *** #### **Article 5: Governance and Organisation** DORAedge is built on a foundation of controls designed to meet the governance requirements outlined in this Article. It enables financial entities to track and implement relevant policies and procedures. The platform provides a clear overview of which controls have been completed, with the ability to export these for internal review or external audits. For entities lacking in-house policies, DORAedge’s Legal and Compliance partners are available to help develop these at a reasonable cost. DORAedge also supports the governance framework required for reviewing policies, ensuring compliance with regulatory requirements. **How DORAedge Assists:** * Provides a framework for control tracking and policy management. * Supports policy review and oversight. * Offers access to legal and compliance expertise for policy development. *** #### **Article 6: ICT Risk Management Framework** **Sections 6.1-4**\ DORAedge enables entities to map their internal and external IT and communication networks, covering both in-house systems and outsourced services. The platform supports the identification of risks at the contract, provider, and aggregate levels, helping organizations understand dependencies and weaknesses in their supply chain and risk framework. Automated reviews ensure that these risks are assessed and addressed as required by the regulation. **How DORAedge Assists:** * Comprehensive mapping of ICT networks and providers. * Automated risk assessments and reviews to ensure ongoing compliance. **Section 6.5**\ DORAedge tags each entity and provider with their respective Competent Authority. This enables financial entities to easily send reports to the authority upon request or as part of their annual reporting requirements. **How DORAedge Assists:** * Simplifies reporting to Competent Authorities with automated tagging and submission. **Sections 6.6-10**\ DORAedge offers tooling for tracking gaps in risk management frameworks, including control tracking, risk identification, contractual relationship definitions, and incident logging. While the implementation of a digital operational resilience strategy is the responsibility of the financial entity and its advisors, DORAedge facilitates the accountability and communication needed to ensure these strategies are effective. **How DORAedge Assists:** * Comprehensive tracking of risk management frameworks and controls. * Enhances accountability and communication within the organization for effective risk management. *** #### **Article 7: ICT Systems, Protocols, and Tools** DORAedge requires the input of vendor information for safe handling when adding contracts. Your team’s assessment of vendor suitability ensures compliance with this Article. The system provides reminders for regular reviews, ensuring that this information is up to date. **How DORAedge Assists:** * Frameworks for vendor suitability assessment. * Automated reminders for regular reviews of vendor contracts and suitability. *** #### **Article 8: Identification** DORAedge automates the documentation and classification of ICT-supported business functions, assets, and third-party dependencies. The platform continuously monitors these elements to help identify and manage cyber threats, vulnerabilities, and risk exposures. With scalable features built on proportionality, DORAedge ensures compliance with mandatory reviews, updates, and risk assessments for legacy systems and infrastructure changes. **How DORAedge Assists:** * Automated documentation, classification, and monitoring of ICT assets. * Supports identification and management of cyber threats and risks. * Ensures compliance with required reviews and updates. *** #### **Article 9: Protection and Prevention** **Section 9.1**\ DORAedge identifies the necessary controls for compliance with this Article. While the entity must design and implement specific policies and procedures, DORAedge offers a platform for storing, reviewing, and approving documents, streamlining compliance oversight. **How DORAedge Assists:** * Provides document storage and review tools. * Facilitates compliance oversight with streamlined document approval processes. **Section 9.4**\ DORAedge includes pre-configured roles and permissions to manage access to data, ensuring appropriate levels of entry, editing, review, and approval for users. **How DORAedge Assists:** * Offers role-based access control for secure data management and approval processes. *** #### **Article 10: Detection** DORAedge serves as an incident management platform with Automated Collection Points to monitor and recognize incidents. The platform integrates with external server monitoring tools to automatically generate incident reports in DORAedge. **How DORAedge Assists:** * Provides an automated incident management and recognition system. * Integrates with external tools for server monitoring and incident reporting. *** #### **Article 11: Response and Recovery** **Sections 11.1-2**\ Business continuity plans can be stored, reviewed, and approved within DORAedge as policies. However, defining and implementing these plans, and measuring their effectiveness, remains the responsibility of the entity and its advisors. **How DORAedge Assists:** * Stores and tracks business continuity plans for compliance with annual review and approval requirements. **Section 11.3**\ DORAedge helps implement ICT response and recovery plans, ensuring that these are regularly reviewed and internally audited. The platform provides comprehensive tools for managing audit cycles and maintaining audit trails for compliance oversight. **How DORAedge Assists:** * Tracks review and audit cycles for response and recovery plans. * Maintains detailed audit trails for compliance oversight. **Section 11.5**\ DORAedge includes a robust Risk Scenario module, allowing organizations to identify and assess risk scenarios. While DORAedge does not include a full Business Impact Analysis (BIA), it provides the necessary data and tools to help financial entities conduct their own assessments, simplifying the process and improving resilience. **How DORAedge Assists:** * Risk Scenario module for identifying and assessing risk scenarios. * Provides data for conducting Business Impact Analysis. *** #### **Article 12: Backup, Restoration, and Recovery Procedures** DORAedge supports the storage and management of IT backup policies, procedures, and business continuity plans. While defining and implementing these plans is the responsibility of the entity, DORAedge ensures they are regularly reviewed and kept up to date. **How DORAedge Assists:** * Stores and tracks IT backup and continuity plans. * Ensures policies are reviewed and updated within required timeframes. *** #### **Article 13: Learning and Evolving** DORAedge logs and tracks critical information on an entity’s digital operations, identifying risks and gaps in the existing network and risk framework. By centralizing accountability and transparency, DORAedge helps organizations enhance their risk posture and strengthen operational resilience. **How DORAedge Assists:** * Centralizes accountability and transparency across digital operations. * Tracks historical and real-time data to improve risk posture and resilience. *** #### **Article 14: Communication** DORAedge enables entities to maintain and review communication policies, but the responsibility for developing a proper communication plan remains with the financial entity and its advisors. The platform stores and tracks these policies to ensure they are reviewed and updated regularly. **How DORAedge Assists:** * Stores and tracks communication policies for regular review. * Helps ensure compliance with internal and external communication requirements. ### Tabular formatting of above:
Article # and DescriptionDORAedge coverage
5 - Governance and organisationBroadly, DORAedge is built on a foundation of controls to meet the requirements of each Article. For a series of the controls in DORAedge, these may be satisfied through the development and implementation of relevant policies and procedures. Controls will show as completed or not yet completed, and this overview is exportable.

If a Financial Entity does not have proper policies in place, and do not want to build these in-house, DORAedge's Legal and Compliance partners can help to develop these at reasonable costs. DORAedge as a platform providers the governance framework for reviewing policies as required by the regulation.
6.1-4 - ICT risk management frameworkAfter fully mapping out their internal and external Information Technology and Communication network - both in-house systems and outsourced providers for critical and non-critical services, the entities may map risks both on a contract and provider level, as well as in aggregate to understand dependencies and weaknesses in their current supply chain and risk framework. In addition the system automatically makes sure these are reviewed and assessed as required by the regulation
6.5 - ICT risk management frameworkThe system tags each entity and provider to one or multiple Competent Authority and can be easily sent to them directly if requested or to achieve annual reporting requirements. In
6.6-10 - ICT risk management frameworkDORAedge offers a tooling for tracking the gaps in and effectiveness of an entity's risk management framework with control tracking, risk identification, contractual relationship definitions, incident logging and reporting, etc. However, the implementation of a digital operational resilience strategy that mirrors the complexity and scope of the organization is left to their own discretion and that of their external legal and compliance advisors.

With provider and contract owners, as well as the ability to log and share incidents will lead to great accountability and knowledge sharing in organizations that might otherwise not have the appropriate risk framework and communication channels in place to appropriate capture and share information that can be used to mitigate and prevent future risks.
7 - ICT systems, protocols and toolsFor compliance with Article 7 of the regulation, DORAedge requires information about the appropriateness of the vendor for safekeeping when adding a contract. To determine a provider's suitability, we rely on your team's assessment. The system establishes frameworks and sends reminders to review this information at regular intervals.

8 - IdentificationDORAedge simplifies compliance with DORA’s ICT risk management by automating the documentation, classification, and continuous monitoring of your ICT-supported business functions, assets, and third-party dependencies. It helps you identify and manage cyber threats, vulnerabilities, and risk exposures in real time, while also streamlining critical asset mapping and third-party provider management. Scalable and built with proportionality in mind, DORAedge ensures you stay compliant with mandatory reviews, updates, and risk assessments for legacy systems and major infrastructure changes—all in one intuitive platform.
9 - Protection and preventionDORAedge helps identify the necessary controls to comply with this Article. However, the specific policies and procedures for compliance must be designed and implemented by the entity itself. DORAedge provides a platform to store, review, and approve these documents, ensuring compliance oversight remains streamlined and accessible.
9.2 - Protection and preventionPlease see (7)
9.4 - Protection and preventionDORAedge ships with a set of Roles to address various levels of permissions to enable data entry, editor, review, and approval levels of access.
10 - DetectionUsing it's Automated Collection Points, DORAedge can act as a full incident management and recognition platform. If internal processes require monitoring, we recommend partners for server monitoring, that can automatically create incidents in DORAedge
11.1-2 - Response and recoveryA business continuity plan, seen as a Policy in DORAedge, can of course be maintained on the platform for review and annual approval, but the definition, implementation, measuring the success of this plan is up to the interpretation of the entity and their legal and compliance team/advisors.
11.3 - Response and recoveryDORAedge not only helps implement ICT response and recovery plans in line with Article 6(1), but also includes controls to verify that these plans are regularly reviewed and internally audited. The platform ensures that audit requirements are met by providing tools for tracking, storing, and managing review cycles, while maintaining comprehensive audit trails for compliance oversight.
11.5 - Response and recovery DORAedge empowers your organization with a robust Risk Scenario module, allowing you to identify risk scenarios and treatments that feed directly into your organizational compliance score and risk overview. While the full Business Impact Analysis (BIA) isn’t included in the initial release, DORAedge provides the critical data you need—such as scenario analysis—right at your fingertips. You can easily export this information into a ready-to-use starter pack, simplifying and speeding up your BIA process. Leverage DORAedge to ensure your organization stays resilient and ready for any disruption.
11.6-10 - Response and recovery Similar to 11.1-2, DORAedge will not carry out testing, but those Policies can be stored on the platform and tied to the relevant controls. DORAedge is the platform to capture relevant documentation for both central storage and reporting to Competent Authorities.
12 - Backup, restoration, and recovery procedures and methodsThese Articles can be covered through IT backup policy/procedures and business continuity plans, of which the entity and their legal compliance team/advisors can define and implement, as it pertains to the complexity and scope of the organization. DORAedge can maintain these policies or continuity plans and ensure they are reviewed within the reguired timeframes. In addition, the system helps companies realise which external providers complies with the compatable
13 - Learning and evolvingDORAedge serves as a comprehensive platform to log and track critical information about an entity's digital operations, identifying risks and gaps within their existing network and risk framework. More than just a data repository, DORAedge centralizes accountability and transparency across your supply chain, contracts, dependencies, and risks. By capturing both historical and real-time data in one place, it empowers organizations to enhance their risk posture and operational resilience.
14 - CommunicationEntities shall determine, based upon their complexity and scope, the proper communication plan(s) required to appropriately communicate required information on a need-to-know to action-required basis. These policies can be maintained and review in the system, but the entity itself and their legal and compliance team/advisors will need to develop a plan that works best for them.
# Chapter III: Incident Reporting (Articles 17-23) See how DORAedge can reduce the complexity of DORA compliant ICT incident management with automated tracking, classification, and streamlined reporting, ensuring compliance and operational resilience. #### Article 17.1: ICT-Related Incident Management Process Financial entities must establish and implement an ICT-related incident management process that enables them to detect, manage, and notify about ICT-related incidents. **How DORAedge Assists:** * Helps set up and maintain a complete ICT-related incident management process. * Automates the detection, recording, and tracking of ICT-related incidents. * Facilitates compliance with notifications for reporting procedures to authorities or stakeholders. *** #### Article 17.2: Incident Recording and Root Cause Analysis Entities must record all ICT-related incidents and significant cyber threats. They must establish procedures to ensure consistent monitoring, handling, and follow-up to identify and address root causes, preventing incident recurrence. **How DORAedge Assists:** * Proprietary AI-assisted model to assist in labeling and assessments of criticality of incidents ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2FxUH4YSJ5EkuVp2DfHTsV%2Fmadewithai.png?alt=media\&token=4c553dbb-4614-4ac3-8c90-73333e608923) * Provides an integrated platform for recording all ICT-related incidents and cyber threats. This includes an impermutable log with auditable changelogs for every single interaction. * Helps monitor and track incidents from detection to resolution ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2FxUH4YSJ5EkuVp2DfHTsV%2Fmadewithai.png?alt=media\&token=4c553dbb-4614-4ac3-8c90-73333e608923) * Supports root cause analysis and provides tools for documentation and follow-up actions ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2F1ysegmO8r9hO863nJkT1%2Fcomingsoon.png?alt=media\&token=fbcb5274-14d8-416c-8119-2e2741746bc2) *** #### Article 17.3(b): Incident Classification and Categorization Financial entities must have procedures to identify, track, log, categorize, and classify incidents based on their priority and severity, according to the criticality of the services impacted. **How DORAedge Assists:** * Assists with automatic categorization and classification of ICT-related incidents based on AI-model![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2FxUH4YSJ5EkuVp2DfHTsV%2Fmadewithai.png?alt=media\&token=4c553dbb-4614-4ac3-8c90-73333e608923) * Uses predefined criteria to classify incidents by severity and impact on critical services as directed by the regulators![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2FxUH4YSJ5EkuVp2DfHTsV%2Fmadewithai.png?alt=media\&token=4c553dbb-4614-4ac3-8c90-73333e608923) * Provides dashboards to visualize and prioritize incidents in real-time. *** #### Article 17.3(c): Assigning Roles and Responsibilities Entities must assign roles and responsibilities for different incident types and scenarios to ensure appropriate response actions. **How DORAedge Assists:** ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2F1ysegmO8r9hO863nJkT1%2Fcomingsoon.png?alt=media\&token=fbcb5274-14d8-416c-8119-2e2741746bc2) * Allows entities to define and assign roles and responsibilities for various incident types to different persons or User Roles * Provides automated notifications to responsible teams when incidents occur including enrichment of third party data from proprietary AI model. *** #### Article 17.3(d): Communication and Escalation Plans Financial entities must establish communication plans for notifying staff, external stakeholders, and clients, and for internal escalation procedures. These plans should cover customer complaints and information sharing with financial counterparts. **How DORAedge Assists:** ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2F1ysegmO8r9hO863nJkT1%2Fcomingsoon.png?alt=media\&token=fbcb5274-14d8-416c-8119-2e2741746bc2) * Setup forms and checklist custom to your company to follow during an incident * Stores and tracks communication plans for internal and external stakeholders. * Automates escalation procedures for major incidents. * Provides templates for client notifications and ensures compliance with communication requirements. *** #### Article 17.3(e): Reporting to Senior Management Entities must ensure that major incidents are reported to senior management, including their impact, response, and any additional controls put in place to mitigate similar risks in the future. **How DORAedge Assists:** * Automatically escalates major incidents to senior management and/or all users in the system ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2FxUH4YSJ5EkuVp2DfHTsV%2Fmadewithai.png?alt=media\&token=4c553dbb-4614-4ac3-8c90-73333e608923) *** #### Article 17.3(f): Incident Response and Service Restoration Financial entities must establish incident response procedures to mitigate the impact of incidents and ensure services are restored in a timely and secure manner. **How DORAedge Assists:** ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2F1ysegmO8r9hO863nJkT1%2Fcomingsoon.png?alt=media\&token=fbcb5274-14d8-416c-8119-2e2741746bc2) * Tracks service restoration progress and ensures all services are brought back online securely. * Enables post-incident reviews to assess response effectiveness. *** #### Article 18.1: Classification of ICT-Related Incidents Entities must classify incidents based on several criteria, including the number of affected clients, downtime, geographical impact, data loss, criticality of services, and economic impact. **How DORAedge Assists:** * Automatically classifies incidents based on predefined criteria like client impact, downtime, and economic cost ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2FxUH4YSJ5EkuVp2DfHTsV%2Fmadewithai.png?alt=media\&token=4c553dbb-4614-4ac3-8c90-73333e608923) * Tracks and logs data losses and assesses their impact on the confidentiality, integrity, and availability of information. *** #### Article 18.2: Classification of Significant Cyber Threats Financial entities must classify cyber threats as significant based on the criticality of services, the number of clients targeted, and geographical impact. **How DORAedge Assists:** * Integrated into the risks features of DORAedge, which easily asks questions from the RTS around (High materiality thresholds for determining significant cyber threats) * Automates the classification of significant cyber threats based on DORA's impact criteria ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2FxUH4YSJ5EkuVp2DfHTsV%2Fmadewithai.png?alt=media\&token=4c553dbb-4614-4ac3-8c90-73333e608923) *** #### Article 18.3 & 18.4: Regulatory Standards for Incident Classification The ESAs will develop common regulatory technical standards to further define the criteria and thresholds for determining major ICT-related incidents and significant cyber threats. {% hint style="warning" %} DORAedge does not support ESAs or competent authorities as customers. We are solely focused on helping financial entities. This clause governs obligations for other parties than financial entities. {% endhint %} *** #### Article 19.1: Reporting of Major ICT-Related Incidents Entities must report major ICT-related incidents to the relevant competent authority, including initial notifications and periodic updates until the incident is fully resolved. **How DORAedge Assists:** * Automates the **entire** reporting process by processing notifications from Automated Collection Points to helping file notifications to the competant authorities ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2FxUH4YSJ5EkuVp2DfHTsV%2Fmadewithai.png?alt=media\&token=4c553dbb-4614-4ac3-8c90-73333e608923) * Our proprietary AI model with chat function allows you ask contextual questions to an incident including if it should be flagged as a major incident or not ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2FxUH4YSJ5EkuVp2DfHTsV%2Fmadewithai.png?alt=media\&token=4c553dbb-4614-4ac3-8c90-73333e608923) * Ensures all necessary information and assessments is included to comply with reporting requirements including asking the correct questions as described in the RTS. * Tracks reporting deadlines in real time and prompts for status updates to the competent authority. *** #### Article 19.2: Voluntary Reporting of Significant Cyber Threats Financial entities may voluntarily notify authorities about significant cyber threats if they believe the threat poses a risk to the financial system or their clients. **How DORAedge Assists:** * DORAedge does not currently feature any voluntary exchange of information to regulators. *** #### Article 19.3: Informing Clients About Major Incidents Financial entities must notify their clients without undue delay about major incidents and provide information on the measures taken to mitigate the adverse effects. **How DORAedge Assists:** * Create custom rules and activies that needs to be done in relation to incidents ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2F1ysegmO8r9hO863nJkT1%2Fcomingsoon.png?alt=media\&token=fbcb5274-14d8-416c-8119-2e2741746bc2) *** #### Article 19.4: Reporting Requirements Entities must submit an initial notification, intermediate reports as necessary, and a final report after the root cause analysis is complete. **How DORAedge Assists:** * Automates the **entire** reporting process by processing notifications from Automated Collection Points to helping file all necessary reports to the competent authorities ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2FxUH4YSJ5EkuVp2DfHTsV%2Fmadewithai.png?alt=media\&token=4c553dbb-4614-4ac3-8c90-73333e608923) * Our proprietary AI model with chat function allows you ask contextual questions to an incident including if it should be flagged as a major incident or not ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2FxUH4YSJ5EkuVp2DfHTsV%2Fmadewithai.png?alt=media\&token=4c553dbb-4614-4ac3-8c90-73333e608923) * Ensures all necessary information and assessments is included to comply with reporting requirements including asking the correct questions as described in the RTS. * Tracks reporting deadlines in real time and prompts for status updates to the competent authority. *** #### Article 19.5: Outsourcing Reporting Obligations Entities may outsource reporting obligations to third-party service providers but remain responsible for the incident reporting. {% hint style="info" %} We have asked the regulators and ESMA if the use of the DORAedge platform constitutes an outsourcing of article 19. We have not recieved a response, but our interpretations remains that this is not an outsourcing of the obligations, as Financial Entities shall do incident reporting themselves through the DORAedge platform. {% endhint %} *** #### Article 20: Harmonization of Reporting Content and Templates The ESAs will develop standard forms and templates for reporting major ICT-related incidents and significant cyber threats. {% hint style="warning" %} DORAedge does not support ESAs or competent authorities as customers. We are solely focused on helping financial entities. This clause governs obligations for other parties than financial entities. {% endhint %} *** #### Article 21: Centralization of Reporting of Major ICT-Related Incidents The ESAs will explore the feasibility of establishing a single EU Hub for centralizing incident reporting. {% hint style="warning" %} DORAedge does not support ESAs or competent authorities as customers. We are solely focused on helping financial entities. This clause governs obligations for other parties than financial entities. {% endhint %} *** #### Article 22: Supervisory Feedback Authorities may provide feedback or guidance on reported incidents, including anonymized information on similar threats and ways to mitigate impacts. {% hint style="warning" %} DORAedge does not support ESAs or competent authorities as customers. We are solely focused on helping financial entities. This clause governs obligations for other parties than financial entities. {% endhint %} *** #### Article 23: Operational or Security Payment-Related Incidents The incident management and reporting requirements also apply to operational or security payment-related incidents affecting credit institutions, payment institutions, account information service providers, and electronic money institutions. All these institutions are well-suited as users of the DORAedge platform. # Chapter IV: Digital Operational Resilience Testing (Articles 24-27) How DORAedge enables compliance with DORA #### Article 24.1: Establishing a Digital Operational Resilience Testing Program Financial entities, other than microenterprises, must establish, maintain, and review a comprehensive digital operational resilience testing program as part of their ICT risk-management framework to identify weaknesses, deficiencies, and gaps, and to implement corrective measures promptly. **How DORAedge Assists:** * Provides tools for creating and maintaining a comprehensive testing program including fetching timely certifications, and easing the effort required for internal audits. * DORAedge does not carry out audits or penetration tests, but maintains a healthy catalogue of partnerships to providers that can assist. *** #### Article 24.2: Testing Methodologies The testing program must include a range of assessments, tests, methodologies, practices, and tools, as outlined in Articles 25 and 26. *** #### Article 24.3: Risk-Based Approach Entities must follow a risk-based approach when conducting tests, taking into account specific risks, criticality of information assets, and evolving ICT threats. *** #### Article 24.4: Independent Testing Tests must be conducted by independent parties, either internal or external, with sufficient resources, and conflict of interest must be avoided. **How DORAedge Assists:** * Tracks independent testers and ensures proper segregation of duties. ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2F1ysegmO8r9hO863nJkT1%2Fcomingsoon.png?alt=media\&token=fbcb5274-14d8-416c-8119-2e2741746bc2) * Provides audit logs to verify that no conflicts of interest arise during the testing process. *** #### Article 24.5: Prioritizing and Remedying Issues Entities must establish procedures and policies to prioritize, classify, and remedy issues revealed by testing, and validate that weaknesses are addressed. **How DORAedge Assists:** * Tests contents of policies to verify whether this is included in policies ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2FxUH4YSJ5EkuVp2DfHTsV%2Fmadewithai.png?alt=media\&token=4c553dbb-4614-4ac3-8c90-73333e608923) * Provides issue tracking and prioritization tools for managing findings from tests. *** #### Article 24.6: Annual Testing Requirements Financial entities must ensure that all ICT systems and applications supporting critical or important functions are tested at least annually. **How DORAedge Assists:** * Automates the scheduling and execution of annual tests across critical systems. *** #### Article 25.1: Testing of ICT Tools and Systems The digital operational resilience testing program must include a variety of tests such as vulnerability assessments, network security assessments, source code reviews, scenario-based tests, and penetration testing. **How DORAedge Assists:** * Offers automated tools for conducting vulnerability scans, network security assessments, and other tests. * Supports scenario-based testing and penetration testing using integrated platforms. * Ensures consistent and comprehensive testing across ICT systems and tools. *** #### Article 25.2: Pre-Deployment Vulnerability Assessments Central securities depositories and central counterparties must conduct vulnerability assessments before deploying or redeploying applications or ICT services that support critical functions. **How DORAedge Assists:** * Facilitates pre-deployment assessments and tracks changes in applications and services. * Automates vulnerability assessments to detect issues before deployment. * Provides reporting tools to ensure readiness of applications and services for deployment. *** #### Article 25.3: ICT Testing for Microenterprises Microenterprises must perform ICT testing by balancing resource allocation with the urgency, type of risk, and criticality of information assets. **How DORAedge Assists:** * Supports resource-optimized testing strategies tailored for microenterprises. * Allows flexibility in balancing resource constraints with critical testing needs. * Provides simplified tools and templates to assist microenterprises in conducting necessary tests. *** #### Article 26.1: Threat-Led Penetration Testing (TLPT) Financial entities must conduct TLPT at least every three years, covering critical functions and live production systems, with the frequency adjusted by the competent authority based on the risk profile. **How DORAedge Assists:** * Facilitates scheduling and execution of TLPT within the three-year period. * Provides tools for assessing risk profiles to determine the need for more frequent testing. * Supports real-time testing on live systems without compromising service availability. *** #### Article 26.2: Scope of TLPT TLPT must cover critical functions and ICT systems, including those outsourced to third-party providers. **How DORAedge Assists:** * Assists in identifying and documenting critical systems and outsourced functions. * Tracks third-party involvement and ensures their participation in TLPT. * Helps validate testing scope and ensures regulatory compliance for critical functions. *** #### Article 26.3: Third-Party Provider Participation in TLPT Financial entities must ensure third-party ICT service providers participate in TLPT and remain responsible for regulatory compliance. **How DORAedge Assists:** * Manages third-party provider participation and tracks their involvement in TLPT. * Provides templates for third-party contracts and ensures compliance with regulatory requirements. * Automates oversight of third-party services during testing. *** #### Article 26.4: Pooled Testing with Third-Party Providers If third-party providers cannot participate directly in TLPT without impacting their services, entities may use pooled testing involving multiple financial entities. **How DORAedge Assists:** * Supports pooled testing by coordinating multiple entities and third-party providers. * Tracks pooled testing activities and ensures documentation aligns with regulatory standards. * Facilitates communication and reporting between all participants. *** #### Article 26.5: Risk Management During TLPT Financial entities must apply effective risk management controls during TLPT to mitigate impacts on data, assets, and services. **How DORAedge Assists:** * Monitors potential risks to data and assets during TLPT. * Implements risk management controls to minimize disruptions during testing. * Tracks remediation efforts and ensures systems are fully operational post-testing. *** #### Article 26.6: Reporting TLPT Findings After testing, entities must submit a summary of findings, remediation plans, and documentation to the competent authority. **How DORAedge Assists:** * Automatically generates reports based on TLPT findings. * Tracks remediation plans and provides ongoing status updates to the competent authority. * Stores all testing documentation for easy retrieval during audits. *** #### Article 26.7: Attestation of TLPT Results Competent authorities must provide an attestation confirming that TLPT was conducted according to requirements, enabling mutual recognition across authorities. **How DORAedge Assists:** * Manages documentation for obtaining attestation from the competent authority. * Tracks the submission and approval of TLPT reports and findings. * Provides templates and workflows to facilitate the mutual recognition process. *** #### Article 26.8: Contracting External Testers for TLPT Entities must contract external testers for every three TLPT cycles or for significant institutions, ensuring external expertise is engaged. **How DORAedge Assists:** * Tracks testing cycles to ensure compliance with external testing requirements. * Provides a database of certified external testers and manages contracts with them. * Automates the onboarding process for external testers and ensures they meet regulatory criteria. *** #### Article 26.9–26.10: National Competent Authorities for TLPT Member States may designate a single public authority to handle TLPT matters, or delegate tasks to another authority. **How DORAedge Assists:** * Facilitates communication and coordination with national competent authorities. * Manages the delegation of TLPT tasks and tracks authority involvement. * Provides reporting templates to ensure compliance with national-level requirements. *** #### Article 27.1: Requirements for Testers Testers performing TLPT must be reputable, technically capable, certified, and covered by professional indemnity insurance. **How DORAedge Assists:** * Maintains a database of qualified and certified TLPT testers. * Tracks professional indemnity insurance coverage and verifies tester credentials. * Ensures testers adhere to ethical frameworks and best practices. *** #### Article 27.2: Using Internal Testers for TLPT Internal testers may be used under specific conditions, including approval from the competent authority and external threat intelligence involvement. **How DORAedge Assists:** * Tracks internal testing approval from competent authorities. * Ensures external threat intelligence providers are engaged for internal testing scenarios. * Monitors conflicts of interest during internal testing and ensures compliance with regulations. *** #### Article 27.3: Managing TLPT Results Contracts with external testers must ensure sound management of TLPT results, including proper data handling and storage. **How DORAedge Assists:** * Manages contracts with external testers to ensure compliance with data handling policies. * Tracks the generation, storage, and destruction of test data. * Provides audit logs and assurances to minimize business risks during TLPT. # Chapter V: Managing of ICT third-party risk (Articles 28-44) How DORAedge enables compliance with DORA #### **Article 28.1: General Principles for Managing ICT Third-Party Risk** Financial entities must manage ICT third-party risk as part of their overall ICT risk management framework. They remain fully responsible for compliance with the regulation and financial laws, even when using ICT third-party services. **How DORAedge Assists:** * Sets forward a standardised risk management tookit and integrates financial services own ICT third-party risk management within the broader ICT risk management framework. * Tracks compliance and obligations for each third-party provider ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2F1ysegmO8r9hO863nJkT1%2Fcomingsoon.png?alt=media\&token=fbcb5274-14d8-416c-8119-2e2741746bc2) *** #### **Article 28.2: ICT Third-Party Risk Strategy** Entities must develop and regularly review a strategy for managing ICT third-party risk, including policies for critical ICT services provided by third-party providers. **How DORAedge Assists:** * With DORAedge on the team, the financial entity can upload their strategies which will be reconciled against the DORA requirements *** #### **Article 28.3: Register of ICT Third-Party Contracts** Entities must maintain a register of all contractual arrangements with ICT third-party service providers, documenting services that support critical or important functions. They must report annually to competent authorities on new ICT service arrangements. **How DORAedge Assists:** * Manages a centralized register of all ICT third-party contracts and providers, including a full log of historic changes * Automatic LEI code resolvement ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2FxUH4YSJ5EkuVp2DfHTsV%2Fmadewithai.png?alt=media\&token=4c553dbb-4614-4ac3-8c90-73333e608923) * Automates annual reporting to competent authorities. *** #### **Article 28.4: Pre-Contractual Assessment** Before entering into ICT service contracts, entities must assess the risks, conduct due diligence, and evaluate potential conflicts of interest. **How DORAedge Assists:** * DORAedge it self can not conduct the due dilligence nor evaluate conflicts of interest. When destilled into risks, these can be mapped on the DORAedge platform however ![](https://438571872-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtGAuTr6qWatUOAQ8O8RR%2Fuploads%2F1ysegmO8r9hO863nJkT1%2Fcomingsoon.png?alt=media\&token=fbcb5274-14d8-416c-8119-2e2741746bc2) *** #### **Article 28.5: Information Security Standards** Entities may only contract ICT third-party providers that comply with appropriate information security standards. **How DORAedge Assists:** * Tracks compliance with information security standards for all third-party providers. * Ensures critical service providers meet the highest standards before contracting and continously requests updates for certifications etc. *** #### **Article 28.6 : Audit Rights** Financial entities must establish audit rights over ICT third-party service providers, ensuring appropriate audit frequency and auditor expertise. **How DORAedge Assists:** * This should be encompassed into the contracts of the ICT and financial entity. *** #### **Article 28.7: Termination of ICT Contracts** Entities must ensure contracts can be terminated in cases of regulatory breaches, poor performance, or ICT service provider failure. **How DORAedge Assists:** * This should be encompassed into the contracts of the ICT and financial entity. *** #### **Article 28.8: Exit Strategies** Entities must have exit strategies for ICT services supporting critical functions, ensuring continuity of business operations and compliance with regulatory requirements during transition or termination of services. **How DORAedge Assists:** * Provides tools for documenting exit strategies. *** #### **Article 29: Preliminary Assessment of ICT Concentration Risk** Entities must assess the risks of concentration when relying on a single ICT third-party provider for critical services or if multiple services are outsourced to closely connected providers. **How DORAedge Assists:** * Tracks concentration risks natively diversification strategies. * Analyzes subcontracting chains for critical services and highlights risks *** #### **Article 30: Key Contractual Provisions** Contracts with ICT third-party providers must clearly define rights and obligations, service locations, data protection provisions, and contingency plans. **How DORAedge Assists:** * Provides templates and structured questionaires for ICT service contracts, ensuring inclusion of all necessary provisions. * Backed up, always available repository for all information and contingency plans. *** #### **Article 31–44: Oversight of Critical ICT Third-Party Providers** These articles detail the oversight framework for critical ICT third-party service providers, including the designation of critical providers, the Lead Overseer's responsibilities, and international cooperation. These provisions largely pertain to the **ESAs** and other oversight bodies rather than directly to financial entities. {% hint style="warning" %} DORAedge does not support ESAs or competent authorities as customers. We are solely focused on helping financial entities. This clause governs obligations for other parties than financial entities. {% endhint %} *** #### **Article 31: Designation of Critical ICT Third-Party Providers (Relevant to ESAs)** The ESAs, through the Joint Committee, will designate critical ICT third-party providers and assign Lead Overseers to ensure oversight of these providers. **Note:** This does not apply to financial entities, but affects their relationship with critical providers once designated. {% hint style="warning" %} DORAedge does not support ESAs or competent authorities as customers. We are solely focused on helping financial entities. This clause governs obligations for other parties than financial entities. {% endhint %} *** #### **Article 32: Structure of the Oversight Framework (Relevant to ESAs)** The ESAs will establish the Oversight Forum to monitor ICT third-party risks and facilitate coordination across financial sectors. **Note:** This pertains to oversight responsibilities and is not directly relevant to financial entities. {% hint style="warning" %} DORAedge does not support ESAs or competent authorities as customers. We are solely focused on helping financial entities. This clause governs obligations for other parties than financial entities. {% endhint %} *** #### **Article 33–35: Powers and Tasks of the Lead Overseer (Relevant to ESAs)** The Lead Overseer will conduct assessments, investigations, and issue recommendations to critical ICT third-party providers to manage their ICT risks effectively. **Note:** Financial entities may receive instructions based on the Lead Overseer’s findings, but these tasks fall under the ESA's remit. {% hint style="warning" %} DORAedge does not support ESAs or competent authorities as customers. We are solely focused on helping financial entities. This clause governs obligations for other parties than financial entities. {% endhint %} *** #### **Article 36–37: Oversight and Inspections (Relevant to ESAs)** The Lead Overseer, in coordination with other authorities, will conduct inspections and request information from critical ICT third-party providers. **Note:** This oversight function pertains to ICT service providers and is not directly applicable to financial entities. {% hint style="warning" %} DORAedge does not support ESAs or competent authorities as customers. We are solely focused on helping financial entities. This clause governs obligations for other parties than financial entities. {% endhint %} *** #### **Article 38–40: General Investigations, Inspections, and Ongoing Oversight (Relevant to ESAs)** The Lead Overseer will carry out general investigations and inspections of critical ICT third-party service providers, including premises inspections and audits. **Note:** Financial entities may need to cooperate, but this is primarily focused on critical ICT providers. {% hint style="warning" %} DORAedge does not support ESAs or competent authorities as customers. We are solely focused on helping financial entities. This clause governs obligations for other parties than financial entities. {% endhint %} *** #### **Article 41: Harmonization of Oversight Conditions (Relevant to ESAs)** The ESAs will develop technical standards to ensure consistent oversight of ICT third-party providers, including subcontracting arrangements and audit templates. **Note:** This task is assigned to the ESAs and is not directly relevant to financial entities. {% hint style="warning" %} DORAedge does not support ESAs or competent authorities as customers. We are solely focused on helping financial entities. This clause governs obligations for other parties than financial entities. {% endhint %} *** #### **Article 42–43: Follow-Up and Fees for Oversight (Relevant to ESAs)** The Lead Overseer will issue follow-up recommendations, and critical ICT third-party service providers must pay oversight fees to cover the costs of oversight activities. **Note:** Financial entities may be indirectly affected by these provisions through their ICT service providers but are not directly responsible for these tasks. {% hint style="warning" %} DORAedge does not support ESAs or competent authorities as customers. We are solely focused on helping financial entities. This clause governs obligations for other parties than financial entities. {% endhint %} *** #### **Article 44: International Cooperation (Relevant to ESAs)** The ESAs may engage with third-country authorities to ensure consistent oversight of ICT third-party providers across jurisdictions. **Note:** This is relevant for cross-border regulatory cooperation and does not directly impact financial entities. {% hint style="warning" %} DORAedge does not support ESAs or competent authorities as customers. We are solely focused on helping financial entities. This clause governs obligations for other parties than financial entities. {% endhint %} # Chapter VI: Information-sharing Arrangements (Article 45) How DORAedge enables compliance with DORA #### **Article 45.1: Cyber Threat Information Sharing** Financial entities **may exchange** cyber threat information among themselves, including indicators of compromise, tactics, techniques, and procedures. This information-sharing aims to enhance the digital operational resilience of the participating financial entities. **How DORAedge Assists:** DORAedge does not arrange any information-sharing agreements for the time being. *** #### **Article 45.2: Information-Sharing Arrangements** Information-sharing must take place within trusted communities and comply with business confidentiality, data protection (GDPR), and competition policies. **How DORAedge Assists:** DORAedge does not arrange any information-sharing agreements for the time being. *** #### **Article 45.3: Notification of Participation** Financial entities must notify competent authorities when they join or leave information-sharing arrangements. **How DORAedge Assists:** DORAedge does not arrange any information-sharing agreements for the time being. # Chapter VII: Competent Authorities (Articles 46-56) {% hint style="warning" %} DORAedge does not support ESAs or competent authorities as customers. We are solely focused on helping financial entities. This clause governs obligations for other parties than financial entities. {% endhint %} # Competent Authorities List of Competent Authorities that Entities can report their
Member StateCompetent Authority Name (English)Competent Authority Name (Native Language)AbbreviationDescription
AustriaFinancial Market AuthorityFinanzmarktaufsichtFMAFinancial regulator overseeing markets, banking, and insurance sectors in Austria.
BelgiumFinancial Services and Markets AuthorityFSMASupervises financial markets and services in Belgium.
BelgiumNational Bank of BelgiumNBBThe central bank responsible for monetary policy and financial stability in Belgium.
BulgariaFinancial Supervision CommissionFSCRegulates non-banking financial institutions in Bulgaria.
BulgariaBulgarian National BankBNBThe central bank of Bulgaria, responsible for monetary policy and banking supervision.
CroatiaCroatian Financial Services Supervisory AgencyHANFARegulates financial markets and supervises non-bank entities in Croatia.
CroatiaCroatian National BankHNBThe central bank responsible for monetary policy and financial stability in Croatia.
CyprusCyprus Securities and Exchange CommissionCySECRegulates capital markets and securities in Cyprus.
CyprusCentral Bank of CyprusCBCThe central bank responsible for monetary and financial stability in Cyprus.
Czech RepublicCzech National BankČeská národní bankaCNBThe central bank of the Czech Republic, overseeing banking and financial stability.
DenmarkDanish Financial Supervisory AuthorityFinanstilsynetDFSARegulates financial services, including banks, insurance, and securities in Denmark.
EstoniaEstonian Financial Supervision and Resolution AuthorityFinantsinspektsioonEFSASupervises financial institutions and ensures resolution mechanisms in Estonia.
FinlandFinancial Supervisory AuthorityFinanssivalvontaFIN-FSASupervises financial markets, including banks and insurance in Finland.
FranceAutorité des Marchés FinanciersAMFRegulates securities markets in France.
FranceAutorité de Contrôle Prudentiel et de RésolutionACPROversees prudential supervision of banks and insurance companies in France.
GermanyFederal Financial Supervisory AuthorityBundesanstalt für FinanzdienstleistungsaufsichtBaFinThe main regulatory body overseeing financial markets and institutions in Germany.
GermanyDeutsche BundesbankDeutsche BundesbankThe central bank responsible for monetary policy and financial stability in Germany.
GreeceHellenic Capital Market CommissionHCMCSupervises capital markets and securities in Greece.
GreeceBank of GreeceBank of GreeceThe central bank responsible for monetary policy and financial stability in Greece.
HungaryHungarian National BankMagyar Nemzeti BankMNBThe central bank of Hungary, overseeing financial stability and monetary policy.
IrelandCentral Bank of IrelandCBIThe central bank responsible for financial regulation and stability in Ireland.
ItalyItalian Companies and Exchange CommissionCommissione Nazionale per le Società e la BorsaCONSOBSupervises companies and securities markets in Italy.
ItalyBank of ItalyBanca d’ItaliaBank of ItalyThe central bank responsible for monetary and financial stability in Italy.
LatviaFinancial and Capital Market CommissionFinanšu un kapitāla tirgus komisijaFCMCRegulates and supervises financial and capital markets in Latvia.
LithuaniaBank of LithuaniaLietuvos BankasBank of LithuaniaThe central bank responsible for monetary policy and financial stability in Lithuania.
LuxembourgCommission de Surveillance du Secteur FinancierCSSFSupervises financial markets, including banks and investment services in Luxembourg.
LuxembourgCentral Bank of LuxembourgBanque centrale du LuxembourgBCLThe central bank responsible for monetary policy and financial stability in Luxembourg.
MaltaMalta Financial Services AuthorityMFSARegulates financial services, including securities and banking in Malta.
MaltaCentral Bank of MaltaCentral Bank of MaltaThe central bank responsible for monetary and financial stability in Malta.
NetherlandsDutch Authority for the Financial MarketsAutoriteit Financiële MarktenAFMRegulates financial markets and investment services in the Netherlands.
NetherlandsDe Nederlandsche BankDNBThe central bank responsible for monetary policy and financial stability in the Netherlands.
PolandPolish Financial Supervision AuthorityKomisja Nadzoru FinansowegoKNFThe main financial regulatory body overseeing markets and services in Poland.
PortugalPortuguese Securities Market CommissionComissão do Mercado de Valores MobiliáriosCMVMSupervises securities markets and investment services in Portugal.
PortugalBank of PortugalBanco de PortugalBank of PortugalThe central bank responsible for monetary and financial stability in Portugal.
RomaniaFinancial Supervisory AuthorityASFSupervises financial markets and services in Romania.
RomaniaNational Bank of RomaniaBNRThe central bank responsible for monetary policy and financial stability in Romania.
SlovakiaNational Bank of SlovakiaNárodná banka SlovenskaNBSThe central bank responsible for monetary policy and financial stability in Slovakia.
SloveniaSecurities Market AgencyAgencija za trg vrednostnih papirjevATVPSupervises securities and capital markets in Slovenia.
SloveniaBank of SloveniaBanka SlovenijeBank of SloveniaThe central bank responsible for monetary policy and financial stability in Slovenia.
SpainNational Securities Market CommissionComisión Nacional del Mercado de ValoresCNMVSupervises securities markets and investment services in Spain.
SpainBank of SpainBanco de EspañaBanco de EspañaThe central bank responsible for monetary policy and financial stability in Spain.
SwedenSwedish Financial Supervisory AuthorityFinansinspektionenFISupervises financial markets, including banking and insurance in Sweden.
# Chapter VIII: Delegate Acts (Article 57) This section outlines the process by which the European Commission can adopt delegated acts under Articles 31(6) and 43(2) of the regulation. 1. **Delegation of Power**: The Commission is given the authority to adopt delegated acts for five years starting from 17 January 2024. This authority will be automatically renewed for the same duration unless the European Parliament or the Council objects within three months of the renewal. 2. **Revocation of Delegation**: The European Parliament or the Council may revoke the delegation of power at any time. The revocation takes effect once it is published in the Official Journal of the European Union. This will not affect any delegated acts that were already in force. 3. **Consultation and Notification**: Before adopting any delegated acts, the Commission must consult with experts designated by each Member State. Once a delegated act is adopted, the Commission is required to notify both the European Parliament and the Council. 4. **Objection Period**: The delegated act will only come into force if neither the European Parliament nor the Council objects within three months of the notification. This period can be extended by an additional three months if needed. This description involves no direct actions or implications for DORAedge or its customers. It is primarily a legislative procedure handled by the European institutions. # Chapter IX: Transitional and Final Provisions (Articles 58-64) How DORAedge enables compliance with DORA **Article 58: Review Clause** This article outlines the responsibilities of the European Commission to review certain aspects of the regulation by specific dates, after consulting with relevant authorities such as the ESAs and the ESRB. The review will assess areas such as the criteria for designating critical ICT third-party service providers, voluntary notifications of significant cyber threats, and oversight of third-country service providers. The review might lead to legislative proposals, but there are no actions required from DORAedge or its customers. **Article 59-63: Amendments to Existing Regulations** These articles detail amendments to various existing EU regulations (e.g., regulations on credit rating agencies, central counterparties, trade repositories, central securities depositories, and financial benchmarks) to align them with the digital operational resilience requirements of Regulation (EU) 2022/2554. These amendments ensure that entities like credit rating agencies, central counterparties, and others maintain proper ICT systems and business continuity plans in accordance with the new regulation. However, there is no direct action required from DORAedge or its customers. **Article 64: Entry into Force and Application** This article specifies that the regulation will enter into force 20 days after its publication in the Official Journal of the European Union and will apply starting from 17 January 2025. No immediate action is required from DORAedge or its customers. # Resource Center # IT Security Overview Performativ, encompassing DORAedge, is an ISO 27001-certified fintech SaaS provider, committed to the highest standards of data protection and security. We comply with GDPR and align with NIST CSF 2.0 to ensure a strong security posture while delivering fast and scalable solutions for our clients. **Governance & Process** * **Security Leadership:** Our CTO, with over 20+ years of experience leading core technology products at highly regulated financial institutions, leads the security strategy and chairs our Risk Control Group which is a collection of our senior operational, technical and security staff, who meet at least monthly to do organization level incident postmortems and risk assessments reporting to the Board. * **SecOps Team:** A dedicated team oversees security infrastructure changes, championing cloud security best practices and ensuring adherence to compliance standards across the company. They also provide technical and process guard rails for the entire technology and data lifecycle. * **Risk Management System:** We operate a comprehensive and highly automated system of risk management, that is integrated into all aspects of our technology and process tool chain and serves as the real time central control center and single pane of glass to consolidate and manage risk in the company on a real time basis. * **Procedures and Processes:** We have formalized operational processes from on and off boarding of customers, and their clients, through to daily operational and data health checks, and operate a comprehensive suite of controls and data reconciliation checks with discipline. Continuous Learning and post-mortem activity are built in as a feedback loop to all core Operational and Technical activities, with an 24/7/365 Incident Rota with global coverage for both first line and escalation paths to the CTO. For all our public policies, see our [Trust Center](https://performativ.trust.site/). * **ISO 27001 Certification:** We undergo an annual recertification process with penetration testing. Continuous monitoring and control are achieved through automated risk management, supported by NIST CSF conformance packs and AWS Config Manager. * **Guiding Principles:** We stay up to date with, and review major security standards, and select the most applicable ones for our clients, with a cultural bias to more security than required. We follow security principles such as least-privilege, shift-left of security, and defense in depth and we take part in the security and fintech communities. **IT Security** * **Access Control & Identity Management:** Multi-factor authentication (MFA) and Single Sign-On (SSO) are enforced across all sensitive systems. Privileged access is granted only temporarily and is fully auditable. Performativ/DORAedge staff have no routine access to sensitive data. In exceptional cases, temporary, auditable access is requested through AWS Session Manager. Timely onboarding (background checks) and off boarding processes (access revocation) are rigorously enforced. * **Network Security:** Following AWS Well Architected and Security Best Practices our networks are partitioned into layers from Public through Private through Isolated with least-privilege Layer 3 and Layer 4 firewalls (security-group), where all public facing APIs and Websites are further protected by Layer 7 firewalls (WAF). * **Infrastructure Security:** We leverage set of best-practice security active policies combined with active intrusion and threat detection as well as infrastructure as code patterns to ensure our infrastructure configurations in the cloud are within security best practice guidelines. * **Software Security:** We leverage binary scanning of deployed software as well as a rigorous patch upgrade SLA supported by tooling ensuring vulnerabilities in binary code or 3rd party libraries are identified and fixed quickly. * **Web Security:** We use standard libraries and frameworks that protect against the main web attack vectors as well as doing continuous static analysis including analysis for known code level security exploits or bad practices within our continuous delivery pipelines. We also deploy all web sites and APIs behind web application Layer 7 firewalls as standard. We conduct at least annual penetration testing. * **API Security:** API services leverage OAuth2 with token rotation, mTLS, API keys, and IP whitelisting. System-to-system trust ensures complete isolation between customers. * **Device Security:** We deploy monitoring and policy enforcement software agents to all staff devices for enhanced endpoint security. * **Third-Party Risk Management:** Suppliers are regularly assessed for security compliance. Key suppliers such as AWS and Auth0 are ISO and SOC certified, with data protection clauses embedded in contracts, **Data Security** * **Data Inventory / Classification:** We deploy multitenancy through isolation of data stores. All data that is stored is classified as to whether it contains personally identifying information or is generally sensitive, and if in any doubt we consider it sensitive. All sensitive repositories of data are tagged automatically ( AWS CDK ) and through that tagging process rules of encryption, backup and retention are enforced. * **Data Encryption:** All sensitive data at rest is encrypted using AES-256, while data in transit uses TLS 1.3 with AES\_128\_GCM encryption and X25519 key exchange. * **Data Privacy:** Access to sensitive data by Performativ/DORAedge personnel is prohibited during routine operations. Highly sensitive data, such as access credentials, is separately stored with independent keys. Short-lived access can be granted for critical operational support or by arrangement for operational roles. * **Data Ownership:** We ensure you can easily access or export your data, supporting open API standards and integration flexibility. Your data is never locked into our platform, if you want to export your data you can interoperate with other systems or if you leave us. We do not share it with any 3rd parties unless they are granted under data processing agreements as vital to the operation of our services. * **Data Sovereignty:** Client data is stored regionally, never transferred across regions unless required. Our default region is Stockholm (EU), but we support non-EU data residency as needed by your local regulatory need or policy. * **Data Backup:** All client data is backed up in independent backup accounts, outside of the primary region in a secondary EU region. The data is backed up at least once a day and is in encrypted data stores, which in the event of an incident can be used to restore from. * **Confidentiality:** Access to client data is on a need-to-know basis in order to best serve and provide support to the customer. * DORAedge systems run on domain-specific services that work with as lean of data structures as possible, minimizing the services that have access to client names. * All data in the DORAedge system is available through modern, secure APIs. Dependent on security settings, this is available through token-based encryption based on JWT. The front-end resources do not share any confidential information in the browser or app cache. * We use OpenAI’s LLM models as the basis for our AI features. OpenAI is SOC2, ISO27001 compliant, encrypts data at rest (AES-256) and in transit (TLS 1.2+). Ownership of your data remains with you. OpenAPI does not train models based on any data provided by you. We operate only with the European subsidiary of OpenAI. # Terms & Conditions **DORAedge subscription Terms & Conditions** **Last updated on December 9, 2024** **1. Introduction** 1.1 These Terms and Conditions govern the use of the DORAedge platform (hereinafter referred to as the “System” or the “Platform”), provided by Performativ (hereinafter the “Provider”), to the customer (hereinafter the “Customer”). Performativ is located at Kronprinsensgade 2, 1114 Copenhagen, Denmark. 1.2 The order confirmation, any appendices, and these Terms and Conditions together constitute the agreement (the “Agreement”) between the Provider and the Customer. In the event of discrepancies, the order confirmation takes precedence. 1.3 If the Customer has entered into an agreement via a third-party administrator (“Partner”), these Terms and Conditions apply to the Customer’s use of the System, irrespective of the agreement with the Partner. **2. License and Usage** 2.1 The Provider grants the Customer a non-exclusive, non-transferable right to use the System during the subscription term (“Term”), as outlined in Clause 13, solely for managing compliance with the Digital Operational Resilience Act (DORA) and related operational processes. 2.2 Access is restricted to the Customer’s personnel and authorized third parties explicitly agreed upon in writing. 2.3 Upon signing up to receive access to the System, a Customer can first begin a trial period, subject to the listed duration, or their subscription Term can begin. Unless the Customer terminates their subscription during the trial period, a subscription Term will begin upon conclusion of the trial period. **3. System Access and Technical Requirements** 3.1 The System is accessible online via commonly used web browsers. Users are responsible for ensuring appropriate technical setups, including internet connectivity and hardware. **4. Customer Usage Limitations** 4.1 The Customer may not sublicense, transfer, or commercially exploit the System without prior written consent. Reverse engineering, decompilation, or circumvention of the System’s technical safeguards is strictly prohibited. 4.2 The customer must keep their user credentials confidential and notify the Provider in case of any loss or breaches, that could compromise these details. 4.3 The customer is allowed only to use the system as intended, and is not allowed to replicate, reverse engineer or reproduce any elements of the system (also see clause 9). Similarly, the customer is not allowed to use the system for any market intelligence gathering or competitive benchmarking of any kind. 4.4 The Provider reserves the right to verify compliance with these Terms and Conditions and may suspend access to the System for violations or non-payment, after due notice. **5. Modifications and Updates** 5.1 The Provider may update, improve or modify the System, with the aim of increasing the utility of the System. Such changes will not affect the obligations of the Customer under this agreement. 5.2 If updates result in Customers being unable to access the System with loss of data that the Provider cannot recover within 30 days, the Customer may terminate their subscription with proportional refunds for unused periods. 5.3 Customers may request changes to the System’s scope, but implementation is at the sole discretion of the Provider. **6. Pricing and Payment** 6.1 Subscriptions are billed in advance, per the chosen billing schedule of monthly or annual payments, and are non-refundable. Pricing is subject to annual adjustments, capped at the higher of the EURO Harmonized Index of Consumer Prices (HICP) or 10% of the previous term’s rates. 6.2 For price changes outside the outlined terms in 6.1, the Customer may terminate their subscription with proportional refunds for unused periods. 6.3 On signup (incl any trail period), a valid method of payment must be selected and entered accordingly. Payment will happen on the first day of the subscription period, for the following subscription term, per 6.1. 6.4 Late payments as a result of invalid or expired payment details are subject to a 3.5% late fee per month. 6.5 The chosen subscription type, cannot be changed to a lower tier during the subscription term. Should the customer subsequently require a lower tier subscription plan, that can be changed at the time of renewal. 6.6 For subscriptions through a Partner, any specific terms listed in that agreement, is handled directly with the Partner, and otherwise follows this present agreement’s terms. **7. Support and Availability** 7.1 The Provider offers technical support via email or voice during European standard business hours. While reasonable efforts are made, specific response times are not guaranteed unless agreed upon in a Service Level Agreement (SLA). 7.2 The Provider strives to maintain high availability of the System, with scheduled maintenance or unforeseen disruptions communicated in advance where feasible. **8. Data and Backup** 8.1 Customer data remain the property of the Customer. The Provider will retain backups for up to 12 months post-termination, ensuring secure and organized storage practices. 8.2 Anonymized data may be used by the Provider for statistical and performance improvement purposes. **9. Intellectual Property** 9.1 All intellectual property rights to the System and related documentation are retained by the Provider or its licensors. Customer rights are limited to those explicitly granted in this Agreement. 9.2 Customers warrant that all uploaded data complies with applicable laws and does not infringe third-party rights. **10. Personal Data Protection** 10.1 The Provider acts as a data processor for Customer data, governed by a separate Data Processing Agreement (DPA). Customers or Partners, as controllers, are responsible for compliance with data protection laws. 10.2 The Provider maintains confidentiality of all personal data and processes it strictly within the terms of the DPA. **11. Confidentiality** 11.1 Both parties agree to safeguard each other’s confidential information, except for disclosures required by law or regulations. System-related data confidentiality is governed by the DPA. **12. Warranties and Liability** 12.1 The Provider does not warrant uninterrupted or error-free operation of the System. Efforts will be made to address issues within reasonable timeframes. 12.2 The Provider’s liability is limited to direct losses up to the value of one year’s subscription fees. Indirect, consequential, or data-related losses are excluded to the fullest extent permitted by law. **13. Termination and Expiry** 13.1 Subscriptions are for a 12-month Term and renew automatically unless the Customer’s billing admin terminates the subscription through Stripe. 13.2 Upon termination, the Provider will securely delete Customer data within 12 months, subject to data extraction requests from the Customer. **14. Governing Law and Disputes** 14.1 This Agreement is governed by Danish law. Disputes will be settled in Danish courts, with the Provider’s venue as the jurisdiction. # Data Processing Agreement (DPA) *** **DORAedge platform Data Processing Agreement** **Last updated December 9, 2024** **Data processing agreement (Addendum for customers who have an active customer relationship with Performativ ApS)** For the purposes of Article 28(3) of Regulation 2016/679 (the GDPR)   Between     The customer named in the Software Subscription Agreement (The data controller)   and    Performativ ApS \ CVR 41540001  \ Kronprinsensgade 2, 2  \ 1114 København K  \ Denmark    (The data processor)  each a ‘party’; together ‘the parties’  HAVE AGREED on the following Clauses in order to meet the requirements of the GDPR and to ensure the protection of the rights of the data subject.  *** #### Table of Contents * Introduction * The rights and obligations of the data controller * The data processor acts according to instructions * Confidentiality * Security of processing * Use of sub-processors * Transfer of data to third countries or international obligations * Assistance to the data controller * Notification of personal data breach * Erasure and return of data * Audit and inspection * The parties' agreement on other terms * Commencement and termination * Appendix A - Information about the processing * Appendix B - Authorised sub-processors * Appendix C - Instruction pertaining to the use of personal data *** #### 1. Introduction 1. These Contractual Clauses (the Clauses) set out the rights and obligations of the data controller and Performativ, when processing personal data on behalf of the data controller in operating DORAedge. 2. The Clauses have been designed to ensure the parties’ compliance with Article 28(3) of Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation). 3. In the context of the provision of Performativ, Performativ will process personal data on behalf of the data controller in accordance with the Clauses. 4. The Clauses shall take priority over any similar provisions contained in other agreements between the parties. 5. Three appendices are attached to the Clauses and form an integral part of the Clauses. 6. Appendix A contains details about the processing of personal data, including the purpose and nature of the processing, type of personal data, categories of data subject and duration of the processing. 7. Appendix B contains the data controller’s conditions for Performativ’s use of sub-processors and a list of sub-processors authorised by the data controller. 8. Appendix C contains the data controller’s instructions with regards to the processing of personal data, the minimum-security measures to be implemented by Performativ and how audits of Performativ and any sub-processors are to be performed. 9. The Clauses along with appendices shall be retained in writing, including electronically, by both parties. 10. The Clauses shall not exempt Performativ from obligations to which Performativ is subject pursuant to the General Data Protection Regulation (the GDPR) or other legislation. *** #### 2. The rights and obligations of the data controller 1. The data controller is responsible for ensuring that the processing of personal data takes place in compliance with the GDPR (see Article 24 GDPR), the applicable EU or Member State1 data protection provisions and the Clauses. 2. The data controller has the right and obligation to make decisions about the purposes and means of the processing of personal data. 3. The data controller shall be responsible, among other, for ensuring that the processing of personal data, which Performativ is instructed to perform, has a legal basis. *** #### 3. The data processor acts according to instuctions 1. Performativ shall process personal data only on documented instructions from the data controller, unless required to do so by Union or Member State law to which the processor is subject. Such instructions shall be specified in appendices A and C. Subsequent instructions can also be given by the data controller throughout the duration of the processing of personal data, but such instructions shall always be documented and kept in writing, including electronically, in connection with the Clauses. 2. Performativ shall immediately inform the data controller if instructions given by the data controller, in the opinion of Performativ, contravene the GDPR or the applicable EU or Member State data protection provisions. *** #### 4. Confidentiality 1. Performativ shall only grant access to the personal data being processed on behalf of the data controller to persons under Performativ’s authority who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and only on a need-to-know basis. The list of persons to whom access has been granted can at the request be reviewed. Based on this review, such access to personal data can be withdrawn, if access is no longer necessary, and personal data shall consequently not be accessible anymore to those persons. 2. Performativ shall at the request of the data controller demonstrate that the concerned persons under Performativ’s authority are subject to the abovementioned confidentiality. *** #### 5. Security of Process 1. Article 32 GDPR stipulates that, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the data controller and data processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. The data controller shall evaluate the risks to the rights and freedoms of natural persons inherent in the processing and implement measures to mitigate those risks. Depending on their relevance, the measures may include the following: 1. Pseudonymisation and encryption of personal data 2. the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services 3. the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident 4. a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing. 2. According to Article 32 GDPR, Performativ shall also – independently from the data controller – evaluate the risks to the rights and freedoms of natural persons inherent in the processing and implement measures to mitigate those risks. To this effect, the data controller shall provide Performativ with all information necessary to identify and evaluate such risks. 3. Furthermore, Performativ shall assist the data controller in ensuring compliance with the data controller’s obligations pursuant to Articles 32 GDPR, by inter alia providing the data controller with information concerning the technical and organisational measures already implemented by Performativ pursuant to Article 32 GDPR along with all other information necessary for the data controller to comply with the data controller’s obligation under Article 32 GDPR. *** #### 6. Use of sub-processors 1. Performativ shall meet the requirements specified in Article 28(2) and (4) GDPR in order to engage another processor (a sub-processor). 2. Performativ shall therefore not engage another processor (sub-processor) for the fulfilment of the Clauses without the prior general written authorisation of the data controller. 3. Performativ has the data controller’s general authorisation for the engagement of sub-processors. Performativ shall inform in writing the data controller of any intended changes concerning the addition or replacement of sub-processors at least 14 days in advance, thereby giving the data controller the opportunity to object to such changes prior to the engagement of the concerned sub-processor(s). Longer time periods of prior notice for specific sub-processing services can be provided in Appendix B. The list of sub-processors already authorised by the data controller can be found in Appendix B. 4. Where Performativ engages a sub-processor for carrying out specific processing activities on behalf of the data controller, the same data protection obligations as set out in the Clauses shall be imposed on that sub-processor by way of a contract or other legal act under EU or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the Clauses and the GDPR. 5. Performativ shall therefore be responsible for requiring that the sub-processor at least complies with the obligations to which Performativ is subject pursuant to the Clauses and the GDPR. 6. A copy of such a sub-processor agreement and subsequent amendments shall – at the data controller’s request – be submitted to the data controller, thereby giving the data controller the opportunity to ensure that the same data protection obligations as set out in the Clauses are imposed on the sub-processor. Clauses on business related issues that do not affect the legal data protection content of the sub-processor agreement, shall not require submission to the data controller. 7. Performativ shall agree a third-party beneficiary clause with the sub-processor where – in the event of bankruptcy of Performativ – the data controller shall be a third-party beneficiary to the sub-processor agreement and shall have the right to enforce the agreement against the sub-processor engaged by Performativ, e.g., enabling the data controller to instruct the sub-processor to delete or return the personal data. 8. If the sub-processor does not fulfil his data protection obligations, Performativ shall remain fully liable to the data controller as regards the fulfilment of the obligations of the sub-processor. This does not affect the rights of the data subjects under the GDPR – in particular those foreseen in Articles 79 and 82 GDPR – against the data controller and Performativ, including the sub-processor. *** #### 7. Transfer of data to third countries or international organisations 1. Any transfer of personal data to third countries or international organisations by Performativ shall only occur on the basis of documented instructions from the data controller and shall always take place in compliance with Chapter V GDPR. 2. In case transfers to third countries or international organisations, which Performativ has not been instructed to perform by the data controller, is required under EU or Member State law to which Performativ is subject, Performativ shall inform the data controller of that legal requirement prior to processing unless that law prohibits such information on important grounds of public interest. 3. Without documented instructions from the data controller, Performativ therefore cannot within the framework of the Clauses: 1. transfer personal data to a data controller or a data processor in a third country or in an international organization 2. transfer the processing of personal data to a sub-processor in a third country 3. have the personal data processed in a third country 4. The data controller’s instructions regarding the transfer of personal data to a third country including, if applicable, the transfer tool under Chapter V GDPR on which they are based, shall be set out in Appendix C.6. 5. The Clauses shall not be confused with standard data protection clauses within the meaning of Article 46(2)(c) and (d) GDPR, and the Clauses cannot be relied upon by the parties as a transfer tool under Chapter V GDPR. *** #### 8. Assistance to the data controller 1. Taking into account the nature of the processing, Performativ shall assist the data controller by appropriate technical and organisational measures, insofar as this is possible, in the fulfilment of the data controller’s obligations to respond to requests for exercising the data subject’s rights laid down in Chapter III GDPR. This entails that Performativ shall, insofar as this is possible, assist the data controller in the data controller’s compliance with: 1. the right to be informed when collecting personal data from the data subject 2. the right to be informed when personal data have not been obtained from the data subject 3. the right of access by the data subject 4. the right to rectification 5. the right to erasure (‘the right to be forgotten’) 6. the right to restriction of processing 7. notification obligation regarding rectification or erasure of personal data or restriction of processing 8. the right to data portability 9. the right to object 10. the right not to be subject to a decision based solely on automated processing, including profiling 2. In addition to Performativ’s obligation to assist the data controller pursuant to Clause 6.3., Performativ shall furthermore, taking into account the nature of the processing and the information available to Performativ, assist the data controller in ensuring compliance with: 1. The data controller’s obligation to without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority, Datatilsynet, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons; 2. the data controller’s obligation to without undue delay communicate the personal data breach to the data subject when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons. 3. the data controller’s obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a data protection impact assessment); 4. the data controller’s obligation to consult the competent supervisory authority, Datatilsynet, prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the data controller to mitigate the risk. 3. The parties shall define in Appendix C the appropriate technical and organisational measures by which Performativ is required to assist the data controller as well as the scope and the extent of the assistance required. This applies to the obligations foreseen in Clause 9.1. and 9.2. *** #### 9. Notification of personal data breach 1. In case of any personal data breach, Performativ shall, without undue delay after having become aware of it, notify the data controller of the personal data breach. 2. Performativ’s notification to the data controller shall, if possible, take place within 24 hours after Performativ has become aware of the personal data breach to enable the data controller to comply with the data controller’s obligation to notify the personal data breach to the competent supervisory authority, cf. Article 33 GDPR. 3. In accordance with Clause 9(2)(a), Performativ shall assist the data controller in notifying the personal data breach to the competent supervisory authority, meaning that Performativ is required to assist in obtaining the information listed below which, pursuant to Article 33(3) GDPR, shall be stated in the data controller’s notification to the competent supervisory authority: 1. The nature of the personal data including where possible, the categories and approximate number of data subjects concerned, and the categories and approximate number of personal data records concerned. 2. the likely consequences of the personal data breach. 3. the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects. 4. The parties shall define in Appendix C all the elements to be provided by Performativ when assisting the data controller in the notification of a personal data breach to the competent supervisory authority. *** #### 10. Erasure and return of data 1. On termination of the provision of personal data processing services, Performativ shall be under obligation to delete all personal data processed on behalf of the data controller and certify to the data controller that it has done so unless Union or Member State law requires storage of the personal data. *** #### 11. Audit and inspection 1. Performativ shall make available to the data controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 and the Clauses and allow for and contribute to audits, including inspections, conducted by the data controller, regulator, or another auditor mandated by the data controller. 2. Procedures applicable to the data controller’s audits, including inspections, of Performativ and sub-processors are specified in appendices C.7. 3. Performativ shall be required to provide the supervisory authorities, which pursuant to applicable legislation have access to the data controller’s and data processor’s facilities, or representatives acting on behalf of such supervisory authorities, with access to Performativ’s physical facilities on presentation of appropriate identification. 4. The parties’ agreement on other terms *** #### 12. The parties' agreement on other terms 1. The parties may agree other clauses concerning the provision of the personal data processing service specifying e.g., liability, as long as they do not contradict directly or indirectly the Clauses or prejudice the fundamental rights or freedoms of the data subject and the protection afforded by the GDPR. *** #### 13. Commencement and termination 1. The Clauses shall become effective on the effective date of the subscription termination per the Terms & Conditions. 2. Both parties shall be entitled to require the Clauses renegotiated if changes to the law or inexpediency of the Clauses should give rise to such renegotiation. 3. The Clauses shall apply for the duration of the provision of personal data processing services. For the duration of the provision of personal data processing services, the Clauses cannot be terminated unless other Clauses governing the provision of personal data processing services have been agreed between the parties. 4. If the provision of personal data processing services is terminated, and the personal data is deleted or returned to the data controller pursuant to Clause 11.1. and Appendix C.3., the Clauses may be terminated by written notice by either party. 5. Signature On behalf of the data processor Name Albert Geisler Fox Position CEO Signature \[Electronically] *** #### Appendix A — Information about the processing **A.1. The purpose of the data processor’s processing of personal data on behalf of the data controller is:** The purpose of this data processing agreement is to ensure the parties' compliance with applicable data protection legislation and to document the data controller's instructions to Performativ. The purpose of Performativ’s processing of personal data on behalf of the data controller is to ensure the data controller and its customers' use of Performativ's tools for portfolio management as further specified in the Software Subscription Agreement between Performativ and data controller; in addition, deliver data to the data controller's own or external systems, where the data controller is responsible for the security of the data. **A.2. The data processor’s processing of personal data on behalf of the data controller shall mainly pertain to (the nature of the processing):** Description, continuous valuations, and administration of the data controller's end customer investment portfolios. **A.3. The processing includes the following types of personal data about data subjects:** Name, e-mail address, telephone number, address, national identification number, bank and custody account number, customer number, capital market transactions entered through customer relations in Danish or foreign banks, capital market transactions entered into outside of customer relations with banks. **A.4. Processing includes the following categories of data subject:** * The data controller’s end users; * The data controller’s customers and the customer’s end users; * The data controller’s end users’/ customers’/customers’ end users' employees; * The data controller’s end users / customers’ / customers’ end users’ authorized holders; * Employees of the data controller **A.5. The data processor’s processing of personal data on behalf of the data controller may be performed when the Clauses commence. Processing has the following duration:** Until the customer relationship between data processor and the data controller is terminated *** #### Appendix B — Authorised sub-processors **B.1. Approved sub-processors** On commencement of the Clauses, the data controller authorises the engagement of the following sub-processors:
NameAddressDescription of Processing
NameAddressDescription of Processing
Amazon Web Services EMEA SARL 38 Avenue John F. Kennedy, L-1855, Luxembourg  Data hosting. Data is stored exclusively in data centres in Germany & Sweden
Auth0., Inc 280 Bishopsgate, London, United Kingdom, EC2M 4AG User management. Data is stored exclusively in data centres in Germany
Stripe Payments Europe Limited

3 Dublin Landings,

North Wall Quay,

Dublin 1, Dublin, Ireland

Payment processing and authorization and settlement of transactions. Data is stored in data centres in Ireland and the Netherlands
OpenAI Ireland Limited 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, Dublin 1 AI services including natural language processing. Data is stored in data centres in Ireland
HubSpot, Inc. 199 Bishopsgate, London EC2M 3T Customer relationship management and marketing automation. Data is stored in Germany
Encharge Limited Cherkovna 57, Office 19, Sofia, Bulgaria, 1505 Marketing automation. Data is stored in the United States
*** #### Appendix C — Instruction pertaining to the use of personal data **C.1. The subject of/instruction for the processing** Performativ’s processing of personal data on behalf of the data controller shall be carried out by Performativ performing the following: * Signing the customer relationship’s software subscription agreement * The data controller enters customers client information into the system * The data controller or one of his/her users (internal/external) uses the system’s functions. **C.2. Security of processing** The level of security shall take into account: A high level of security is maintained. It should be taken into account that Performativ neither store nor process the data subject to Article 9 GDPR. Performativ shall hereafter be entitled and under obligation to make decisions about the technical and organisational security measures that are to be applied to create the necessary (and agreed) level of data security. Performativ shall however – in any event and at a minimum – implement the following measures that have been agreed with the data controller: * Anonymize usage data used for usage statistics or error handling: however, exempted when processing usage data for invoicing: The amount of personal data is limited to a minimum level; * Stores the controller’s data separately from other customers’ data; * Ensure a high quality and frequency of backups; * Protect and secure data during transmission from client to server; * Continually, ensure that there is sufficient physical security around servers where personal data is processed or stored; **C.3. Assistance to the data controller** Performativ shall insofar as this is possible – within the scope and the extent of the assistance specified below – assist the data controller in accordance with section 9 by implementing the following technical and organisational measures: Performativ will, without undue delay, after becoming aware, notify the data controller in writing of any request addressed to Performativ or its sub-data processors from a data subject regarding the exercise of his rights in accordance with applicable data protection law. Performativ is not entitled to respond to requests from a data subject regarding the exercise of his rights according to applicable data protection law. Performativ will, at the request of the data controller, assist in fulfilling the data controller's obligations in relation to the rights of the data subjects in accordance with applicable data protection law. Performativ’s assistance in relation to the data controller's obligations according to Articles 33 and 34 of the Data Protection Regulation are carried out by Performativ submitting the information resulting from section 9 to the data controller within the deadline from section 9. Performativ will subsequently assist the data controller by, at the data controller's request, provide the information available which is necessary for the data controller to report a breach of personal data security to Datatilsynet or which is necessary for the data controller to notify the data subject thereof In case the data controller assesses that the processing is likely to entail a high risk for the rights and freedoms of the data subjects, Performativ will, at the request of the data controller, assist the data controller in accordance with his obligations under Articles 35 and 36 of the Data Protection Regulation by submitting the information to the data controller that is necessary for the data controller to carry out an impact analysis in accordance with Article 35 and to carry out a prior consultation with the relevant country Data Protection Authority in accordance with Article 36. Performativ will finally ensure that its technical and organizational measures enable the data controller to comply with its obligations according to the nature of the data protection regulation. 33-36. **C.4. Storage period/erasure procedures** If the data controller has voiced a topic that has personal data associated with it, the data series will be anonymized within 3 months; hereafter deleted completely. Upon termination of the provision of personal data processing services, Performativ shall delete the personal data in accordance with Clause 11.1., unless the data controller – after the signature of the contract – has modified the data controller’s original choice. Such modification shall be documented and kept in writing, including electronically, in connection with the Clauses. **C.5. Instruction on the transfer of personal data to third countries** In relation to the operation, Performativ may have to transfer personal data for processing when found absolutely necessary for the continued operation. **C.6. Procedures for the data controller’s processing of personal data being performed by the data processor** Performativ will, at the request of the data controller – although no more than once a year - at its own expense make a statement regarding Performativ’s and its possible sub-processors' compliance with the data protection regulation, data protection regulations in other EU law or the national law of the member states and regulations with associated annexes. If the data controller assesses that the submitted statement does not sufficiently demonstrate the compliance of Performativ and its possible sub-processors with the data protection regulation, data protection regulations in other EU law of the member states and the Regulations with associated annexes, Performativ will, at the request of the data controller and expense obtain an audit statement from an independent accountant concerning Performativ and its potential sub processors’ compliance with the GDPR, the applicable EU or Member State data protection provisions and the provisions with associated annexes. If Performativ is requested to provide an audit statement in accordance with this point, this will be prepared based on the following types of audit statements: * ISAE 3000, with assurance on description of controls aimed at data protection and processing of personal data. Following further discussions with the data controller, the declaration can be adapted to the concrete relevant standard procedures for Performativ, just as the declaration can be submitted in accordance with another appropriate standard. If the data controller needs to ensure that other requirements are also met, the declaration can be enriched depending on the data controller’s individual needs. The data controller or an independent auditor authorized by the data controller, also has the right to carry out inspections of Performativ’s physical facilities, where personal data is processed, and systems used and related to the processing of, as well as receive the necessary information for carrying out the investigation of whether Performativ has taken the security measures that follow from the regulations and applicable data protection law. This may, for instance, be the case if a specific circumstance, e.g., a security breach, gives rise to doubts about the protection of the personal data of Performativ. The data controller obtains a declaration of confidentiality from the independent auditor. The data controller may contest the methodology for the conducted control measures and may in such cases request a new audit report and/or a new inspection under a revised scope and/or different methodology Based on the results of such control measures, the data controller may request further measures to be taken to ensure compliance with the GDPR, the applicable EU or Member State data protection provisions and the Clauses. The data controller is entitled to pass on information received in accordance with the provisions in this appendix to the Danish Data Protection Authority, upon request from the Danish Data Protection Authority. **C.7. Procedures for audits, including inspections, of the processing of personal data being performed by sub-processors** As a starting point, Performativ determines how the audit of the sub-processor’s compliance with the data protection regulation, data protection provisions in the applicable EU or Member State data protection provisions and how the sub-data processor agreement is carried out, including specifying the type of audit statement and/or inspection report to be obtained. The type and extent of the audit will reflect the nature of the processing of personal data carried out by the sub-processor. Any audit statements and / or inspection reports regarding sub-processors’ processing of personal data covered by the provisions shall without undue delay be submitted to the data controller for information. The data controller may contest the scope for the undertaken control measures and may in such cases request a new audit report and / or a new inspection under a revised scope and/or different methodology. Based on the results of the control measures, the data controller may request further measures to be taken to ensure compliance with the GDPR, the applicable EU or Member State data protection provisions and the data processing agreement. Performativ or Performativ’s representative shall in addition have access to inspect, including physically inspect, the places, where the processing of personal data is carried out by the sub-processors, including physical facilities as well as systems used for and related to the processing. Such an inspection shall be performed, when Performativ (or the data controller) deems it required. Any expenses incurred by Performativ and the sub-processor in connection with carrying out a physical inspection/inspection at the sub-data processor are not the responsibility of the data controller - regardless of the fact that the data controller has initiated and possibly participated in such an inspection. However, Performativ is obliged to allocate the resources (mainly the time) necessary for the data controller to carry out his inspections The data controller’s participation in an inspection of the sub-processor shall not alter the fact that Performativ hereafter continues to bear the full responsibility for the sub-processor’s compliance with the GDPR, the applicable EU or Member State data protection provisions.