Start free checkFree check Book a demo

DORA · Regulation (EU) 2022/2554

Your ICT providers, in one register.

For financial entities under DORA. Keep the ICT third-party register, set recovery objectives on critical functions, find the gaps against supplier SLAs and export the 4 core EBA Register of Information templates.

Book a demoSee the ICT register
DORA compliance dashboard for a demo company: an EBA Export button, overall readiness 82 % across critical functions (100 %), ICT providers (70 %), contracts (100 %) and exit strategies (57 %), and tiles for 7 ICT providers (4 critical), 3 critical functions with RTO and RPO, 5 verified contracts and 4 exit strategies.
ICT register rows for three demo providers: Atlas LLM Inc. (cloud computing, easy to substitute), Fjärrnät Telecom AB (network infrastructure, difficult) and GridSense Systems Oy (software development, not substitutable).
The DORA module: readiness across critical functions, ICT providers, contracts and exit strategies, with the ICT register beside it. Product screens show a fictional demo company.
DORA overall readiness card for a demo company: 82 %, with critical functions at 100 %, ICT providers at 70 %, contracts at 100 % and exit strategies at 57 %.
The DORA module: readiness across critical functions, ICT providers, contracts and exit strategies. Product screens show a fictional demo company.

ICT third-party register

Classified once. Linked to what depends on them.

Classify suppliers as ICT providers once, link them to the functions they support and keep the exit plan with the record.

  • An ICT profile on every provider Service type, how substitutable the provider is and why, the critical functions it supports, its LEI code, and whether an exit strategy is documented, with the estimated transition time and cost.
  • Recovery objectives on the functions that matter Mark a process as a critical or important function, set its RTO and RPO, and link the suppliers that support it.
  • SLA terms read from the contract Upload a supplier contract and AI extracts the RTO, RPO, uptime and dates, each with the quote it came from. You review them and mark the contract verified.
ICT provider classification card: Software Development, Not Substitutable (proprietary SCADA protocol stack), supports critical functions, no exit strategy documented, and an LEI code.
  1. Easy, difficult or not substitutable, with the reason in your own words.
  2. Flagged when the provider supports a critical or important function.
  3. Whether an exit plan is documented, with its transition time and cost when it is.
  4. The legal entity identifier the Register of Information asks for.
  1. Critical functions. Flagged when the provider supports a critical or important function.
  2. Exit strategy. Whether an exit plan is documented, with its transition time and cost when it is.
  3. LEI code. The legal entity identifier the Register of Information asks for.
A supplier’s ICT profile: substitutability, critical functions, exit strategy and LEI, on the supplier record.

Operational resilience gaps

See where a supplier’s SLA falls short.

Fidureon compares each critical function’s recovery objectives with the SLAs of the suppliers behind it, and ranks every gap.

DORA gap analysis of recovery objectives for a demo company: 14 gaps (3 critical, 2 major) comparing each critical process’s required RTO or RPO with the supplier’s actual hours, the difference, a severity and a Create Risk action.
  1. The recovery objective you set on the critical function.
  2. What the supplier’s contract commits to.
  3. Minor, major or critical, from how far the SLA misses the objective.
  4. Turns the gap into a risk in your register, pre-filled with the function, supplier and numbers.
  1. Required. The recovery objective you set on the critical function.
  2. Actual. What the supplier’s contract commits to.
  3. Severity. Minor, major or critical, from how far the SLA misses the objective.
Each critical function’s required RTO or RPO against what its supplier commits to, with the gap and its severity.
  • Minor The SLA is up to 25% longer than the objective.
  • Major Up to twice the objective.
  • Critical More than twice the objective, or no SLA in the contract at all.
  • From gap to risk in one click Create a risk from any gap, pre-filled with the function, supplier and numbers, and treat it in your risk register.
EBA Export wizard for a demo company, step 1 of 4 (select templates, then validate data): template cards for ICT Services, ICT Third-Party Providers, Contractual Arrangements and Critical Functions, all selected, each listing the fields it exports such as providerId, leiCode and startDate.
The Register of Information export: pick the templates, validate the data, then generate.

EBA Register of Information

Export the core templates, after a check.

Pick the reporting period and the templates, see what is missing before you generate, and export as XBRL-CSV from the same records you already keep.

4 Core Register of Information templates Exported as XBRL-CSV
  • B_01.01
  • B_02.01
  • B_03.01
  • B_05.01
  • Validation before export Missing LEI codes, contract dates, RTO and RPO are flagged as errors or warnings, with the record they belong to.
  • Export history Every export is kept with its reporting period and record count.

What the DORA module covers

Third-party risk and resilience, in one place.

The ICT third-party register, resilience against your objectives and the Register of Information export, on the same records the rest of your programme uses.

  • ICT third-party register with critical-function mapping and exit strategies
  • EBA Register of Information export as XBRL-CSV: B_01.01, B_02.01, B_03.01, B_05.01
  • Resilience gaps: process RTO/RPO against supplier SLAs, with AI SLA extraction from contracts
  • DORA dashboard

The suppliers, processes and risks you use here are the same records your ISO 27001 and NIS2 work runs on, so you keep one supplier list, not two. See how Fidureon works once.

FAQ

DORA questions.

What does DORA cover in Fidureon?

DORA in Fidureon is a module for ICT third-party risk and operational resilience: the ICT register, critical functions with recovery objectives, exit strategies, resilience gaps against supplier SLAs and an export of the 4 core EBA Register of Information templates.

Which Register of Information templates does the export cover?

The 4 core templates B_01.01, B_02.01, B_03.01 and B_05.01, exported as XBRL-CSV after a validation step that flags missing data such as LEI codes or unverified contract terms.

How does Fidureon find resilience gaps?

You set a recovery time (RTO) and recovery point (RPO) objective on each critical or important function and link the suppliers that support it. Fidureon compares those objectives with the SLA terms in each supplier’s contract. A gap up to 25% over the objective is minor, up to 100% is major, and anything more, or no SLA at all, is critical. You can turn any gap into a risk in one click.

Does a person check the SLA terms the AI reads from contracts?

They can, and Fidureon shows when no one has. When you upload a contract, AI extracts the RTO, RPO, uptime and dates with a confidence level and the quote each value came from. You review them and mark the contract verified. Until then, gaps are calculated from the extracted values and marked unverified, and the export flags the contract.

How do we get started with DORA?

Book a demo and we will walk through the ICT register and the export on your own providers.

Does DORA count as one of the frameworks in my plan?

DORA is a module rather than a requirements catalogue, so ask us how it counts toward your plan.

Does DORA apply to us?

DORA applies to financial entities in the EU, such as banks, payment and e-money institutions, investment firms and insurers, and has applied since 17 January 2025. Whether and how it applies to you is your assessment to make, with legal advice where you need it.

See your ICT register in Fidureon.

Book a demo and we will walk through the register, your critical functions and the export on your own providers.

Book a demoExplore the platform