DORA · Register & Incidents
The Register of Information (RoI) submission-ready, the reporting cascade deadline-safe: 4 h / 72 h / 30 days – from one data set, with a digitally signed incident report.
The register and the reporting cascade are connected — for regulators and in day-to-day work.
ICT risk officers at banks often describe their challenge this way: "It's DORA, not NIS2 — most compliance tools mix them up immediately." DORA requires in Art. 28/29 a complete register of all ICT third-party service contracts — including criticality classification, LEI identification, and concentration-risk assessment — that can be submitted to regulators in the EBA-ITS-2024/2956 format. And Art. 19 requires classifying a serious ICT-related incident within 4 hours of discovery, followed by an interim report and a final report to FMA or BaFin.
In practice, both run on the same vendor data: an incident at a critical ICT third-party provider automatically touches that provider's concentration-risk assessment in the RoI, and a register without clean criticality classification also makes incident classification harder to justify. Two separate tools — an Excel register here, improvised Word documents under time pressure there — tear that connection apart.
What matters is one service that serves both from the same data set: the register always submission-ready, the reporting cascade with a visible countdown at every tier, Threat-Led Penetration Testing (Art. 26/27) with documented planning — and every state cryptographically sealed, independently verifiable.
Six building blocks for a submission-ready RoI and deadline-safe reporting.
Vendor register with criticality & LEI
Each ICT third-party provider is captured with criticality classification, LEI, and contract data in a structured format — not scattered across spreadsheets and files.
Concentration-risk flag
Clustering by service type and country, single points of failure across critical providers: the concentration analysis per Art. 29 is calculated deterministically from the register and sealed — a resilience response, not an Excel attachment.
RoI versioned & export-ready (CSV T01/T02/T04 + XBRL)
Every version of the register is sealed and cannot be changed undetectably afterward; submission happens directly in the format regulators expect — no manual rebuild of the ESMA-ITS table structure just before the deadline.
Incident register with a 4h / 72h / 30-day reporting clock
Every incident flows through initial report, interim report, and final report as a guided process; from the moment discovery is recorded, the countdown at each tier runs visibly — no need to reconstruct it from memory.
Incident report as digitally signed PDF
The incident report to regulators is generated as a digitally signed PDF with pre-submission validation — so nothing incomplete or malformed gets sent.
TLPT planning & tracking
Threat-Led Penetration Testing cycles under Art. 26/27 are planned and tracked with status — as a standalone, always-ready proof instead of a separate project file.
More about DORA and the infrastructure behind it.
Deadlines, ICT risk management, breach reporting, and primary sources in detail.
Regulation details →How vendor registry, security ratings, and risk assessment work together.
Feature details →How the three-tier reporting protocol and classification countdown work together in workspace.reportact.com.
Function details →