DORA and ISO 27001 Compliance Software

No. A certified ISMS covers part of DORA's expectations on ICT risk governance, but DORA adds its own obligations: the register of information, minimum contractual clauses, exit strategy, resilience testing and major incident reporting.

It is the register of contractual arrangements with ICT providers required by DORA. It identifies each provider, the functions supported, whether they are critical or important, data location and the subcontracting chain, and it is reported to competent authorities.

The Audit module produces signable reports framework by framework, with common evidence reused between DORA and ISO 27001 — evidence collected once is attached to both files.

Each certificate is recorded with its scope and validity date, and triggers an alert before expiry. To an auditor or a supervisor alike, an expired certificate is no certificate.

Around twenty categories of EU financial entities: credit institutions, investment firms, payment institutions, insurers, asset managers, crypto-asset service providers and market infrastructures, among others.