Playbooks
Prepare for DORA
Turn the framework on, keep the vendor register, handle and document incidents and their deadlines, within the limits of the app.
Role: Compliance manager This playbook organizes preparation for Regulation (EU) 2022/2554 (DORA). The app helps you track; it never says you comply.
Warning
The catalogue text is "written in our own words". It does not replace the regulation. Confirm with your counsel what applies to your entity.
1. Turn the framework on
Screen: Frameworks. Turn on DORA (Advanced edition if another framework stays active). DORA does not go through the assessment questionnaire: it enters the score through the common controls that cover it.
2. See what is missing
Screen: Controls. Filter by state and read, for each control, the DORA requirements covered and the expected evidence.
3. Keep the vendor register
Screen: Vendors.
- "Add a vendor": service provided, risk level, critical function, personal data, owner, contract end.
- "Assess": questionnaire or assessment, outcome, date, optional evidence.
- Watch "Contract ended", "To assess", "No owner".
The register is the basis for the DORA register of information but does not generate it yet.
4. Handle incidents and their deadlines
Screen: Incidents (playbook). Choose DORA: the app prepares deadlines (initial notification, intermediate report, final report) from the detection date. You record each submission by hand.
5. Test and prove
Screens: Tests and continuous monitoring, Evidence, Audit pack.
What the app does not do
- It sends nothing to the authorities and does not say a notification is required in your case.
- It does not generate the DORA register of information.
- It does not assess digital operational resilience through penetration tests: it tracks your evidence and monitors.
- It never says your entity complies with DORA.
Was this page helpful?