For financial entities and the ICT providers that serve them

DORA compliance you can show: controls, evidence, risks and providers in one place

AI Pazz Govnex holds the EU Digital Operational Resilience Act — Regulation (EU) 2022/2554, applicable since 17 January 2025 — as 58 ready-made controls, each with the evidence to produce, beside an ICT risk register built for DORA, business continuity analysis and testing, a record of your ICT providers and their contracts, and internal audit. An implementation playbook, delivered with the AI Pazz team, takes a financial entity or an ICT provider from where it stands to the maturity it chooses.

DORA asks a financial entity to show five things: that its management body owns ICT risk, that incidents are classified and reported on time, that systems are tested, that ICT providers are known, contracted and replaceable, and that it learns from all of it. Showing them means a control, an owner and evidence for each requirement. Govnex keeps those in one product, so the answer to a supervisor's question is a record rather than a search.

Start free See pricing

What each of you gets

For the Head of ICT risk

Every requirement with an owner and evidence

  • DORA adopted from the Compliance Library as 58 controls following the regulation chapter by chapter, each assigned to an owner
  • Evidence recorded control by control, cycle by cycle, with what is still missing in view
  • An ICT risk register with categories by DORA's chapters, and every risk tied to the business function it threatens and whether that function is critical or important

For the Compliance and continuity lead

Prove resilience, do not assert it

  • Business impact analysis that derives recovery time and recovery point objectives for the applications and providers each function depends on
  • Continuity plans, call trees, exercises and DR tests recorded, with what each test achieved against its objective
  • Internal audits run against the DORA controls you track, with findings followed to a validated fix

For the ICT provider to financial entities

Be ready for what your customers must ask

  • The controls an ICT provider needs under DORA: contract terms, assurance, incident assistance, audit support, subcontracting and exit
  • One place for the evidence customers request, so each questionnaire is answered from the same record
  • A playbook function written for providers, including readiness for designation as a critical provider

Questions you can answer the day they are asked

By a board, an auditor, a regulator or a finance director — from the record, not from a week of chasing people.

  • Which DORA requirements have an owner and evidence, and which do not?
  • Which of our business functions are critical or important, and what do they run on?
  • Which ICT providers support a critical function, and when do their contracts end?
  • What are our recovery objectives, and did the last test meet them?
  • Which ICT risks are above tolerance, and who is treating them?
  • What did the last incident teach us, and has the change been made?
  • What will the auditor or the supervisor ask for, and where is it?
  • As a provider, which of our customers are financial entities and what have we committed to them?

What you manage, and where

DORA controls and evidence
The Digital Operational Resilience Act as a ready-made reference of 58 controls: ICT risk management, incident management and reporting, resilience testing, ICT third-party risk and information sharing, plus the controls for ICT providers. Each names its article and lists the evidence that shows it is met; you assign owners and record a verdict and evidence for every one.Compliance and Control Tracker
ICT risk register
A register template for ICT and digital operational resilience risk: categories by the regulation's chapters, impact scaled by the criteria DORA classifies incidents by, treatments, closure evidence, and a tolerance matrix every risk is judged against.Risk Tracking
Critical functions, applications and providers
Your processes and services with their owners and criticality, the applications each runs on, and the cloud and hardware providers behind them — each provider with its contracts, renewal dates, owners and the countries your data is hosted in. It is the record a register of information is assembled from; the regulator's own templates are completed outside the product.Process and Technology Governance
Continuity, recovery and testing
Business impact analysis with your own criteria and time frames, recovery objectives derived for applications and providers, continuity plans with teams and call trees, and exercises, crisis simulations and DR tests whose results become each item's tested capability.Business Continuity
Incidents and remediation
Every incident and finding logged with an owner and a due date, escalated when it runs late, and closed on evidence a second person validates — the record behind a post-incident review. Reports to the competent authority are submitted through its own channel, not from the product.Issue & Remediation
Internal audit
The audit plan, fieldwork against the DORA controls you track, workpapers reviewed by a second auditor, findings answered by management and corrective actions followed to closure.Audit Management
An implementation playbook, with AI Pazz
A consultancy programme for DORA: 23 processes in ten functions, each with set-up steps, the evidence that closes them and a standard operating procedure at every maturity level, mapped control by control to the DORA reference. Browse it in the product's catalogue and request a consultation.Process Implementation

DORA compliance: questions and answers

What is DORA and who does it apply to?
The Digital Operational Resilience Act is Regulation (EU) 2022/2554, applicable since 17 January 2025. It applies to financial entities in the European Union — banks, insurers, investment firms, payment and electronic money institutions and others — and reaches the ICT third-party service providers that serve them. It covers ICT risk management, incident management and reporting, resilience testing, ICT third-party risk and information sharing.
How does AI Pazz Govnex help with DORA compliance?
DORA is in the Compliance Library as 58 ready-made controls, each naming its article and the evidence to produce. You adopt them, assign owners and record evidence cycle by cycle. Beside them are an ICT risk register built for DORA, business continuity analysis and testing, a record of ICT providers and their contracts, incident and finding tracking, and internal audit.
Does it produce the DORA register of information?
It holds what the register is built from: your ICT providers, their contracts with dates, owners and value, the functions each supports and where your data is hosted. It does not generate the regulator's standard templates; those are completed from this record outside the product.
Does it submit incident reports to the regulator?
No. Major ICT-related incidents are reported to your competent authority through its own channel. Govnex keeps the incident record, its owner, deadlines and remediation, which is what a classification decision and a post-incident review rest on.
We are an ICT provider, not a financial entity. Is this for us?
Yes. The DORA reference includes the controls a provider serving financial entities needs — contract terms under Article 30, assurance evidence, incident assistance, audit support, subcontracting transparency, testing participation and exit — and the implementation playbook has a function written for providers.
Are the DORA controls the legal text?
No. Article numbers and titles are the regulation's; the requirement and evidence statements are written for compliance tracking. Read them with the regulation and its technical standards, and take advice where your position is unclear.

The modules behind it

Every plan

Compliance management software

Compliance and Control Tracker

Track recurring compliance obligations, assign owners and record the evidence, cycle by cycle.

  • Adopt controls from the Compliance Library — ISO 27001, SOC 2, GDPR, Sri Lanka PDPA and more — as your own editable copies
  • Cycles and assessments whose scope is fixed the moment they open
  • Coverage and maturity scoring, withheld below a coverage floor you set
More about Compliance and Control Tracker
Small business and up

Risk management software

Risk Tracking

Risk registers at every level of the organization: score risks, treat them, evidence their closure, and raise the ones the board should see.

  • As many registers as your organization needs, each run by its own administrator
  • Risks at organization, unit or individual level, each with an owner
  • Optional approval before a risk closes — by the register’s administrator or someone you name
More about Risk Tracking
Small business and up

Process governance, application inventory and IT contract management software

Process and Technology Governance

Govern what the organization does and what it runs on: its processes, services and capabilities — each with an owner, SOPs, KPIs and a review cycle — and its applications and providers — the cloud and hardware they depend on, with their contracts and licences.

  • What the organization does, placed under the unit that does it — capabilities holding the processes that deliver them, and the services it provides
  • SOPs inside each process and service — the procedure written out, with its forms and documents uploaded or linked, and its own review date
  • Applications, cloud providers and hardware providers in one list, told apart by category — each with the company behind it, its criticality and its status
More about Process and Technology Governance
Small business and up

Business impact analysis, continuity planning and DR software

Business Continuity

Work out what the organization cannot be without, and for how long: a business impact analysis of each process and service, with the recovery targets it sets for the applications and providers they run on — then plan how to carry on, show what is critical would come back, and rehearse it — continuity plans with teams and call trees, assessments, DR plans with evidence, and exercises.

  • Your own impact criteria — financial, operational, legal and regulatory, reputation, customers, health and safety to start — each saying what every level means for it
  • A cycle for the processes you pick, for your own unit, for several units, or for the whole catalogue — the yearly round or one process looked at today
  • The RTO, RPO and MTD required of every application derived from the processes that need it — and of every cloud and hardware provider from the applications that run on it
More about Business Continuity
Small business and up

Issue and remediation tracking software

Issue & Remediation

Log what is wrong — gaps, findings, incidents — assign it to whoever has to put it right, and see it closed with evidence and a second pair of eyes.

  • Anyone can open a register and run it: its own severities with target days, categories, custom attributes and visibility
  • A due date from the severity, moved only with a reason that is logged
  • A ladder per register: overdue by so many days, escalate to the administrator, the Module Admins or a named person — worked out live, never stale
More about Issue & Remediation
Small business and up

Internal audit management software

Audit Management

Run internal audit programmes: the scopes audited in each, tests with their samples, findings answered by management, issued reports, and every finding handed over to Issue & Remediation for tracking.

  • The year's audits in one plan, approved by an audit lead — anything added afterwards is marked unplanned until the plan is approved again
  • A work programme generated from the controls you track for the standards in scope — with each control's latest recorded verdict and evidence beside the auditor's own conclusion, never written back
  • Findings written as condition, criteria, cause, effect and recommendation, rated on your own scale, with a link to the earlier finding they repeat
More about Audit Management
Small business and up

Compliance implementation service

Process Implementation

A consultancy service delivered by the AI Pazz team: build a function to your target maturity — operating model, processes, SOPs and the evidence that proves it — step by step.

  • A playbook for the function — Privacy & Data Protection first — with its processes, SOPs, resources and the evidence each maturity level leaves behind
  • Every step up to your target becomes a task with an owner, defaulted from the RACI, and a due date
  • Request the service from the modules page; the team registers your programme
More about Process Implementation

Put your technology on the record

Start with the applications you run and the contracts behind them. The rest joins as you need it.

Start free Every module