DORA

Operational resilience for AI and data in financial services

DORA makes ICT resilience a board-level obligation for financial entities. Scrydon's audit trails, fail-closed defaults and sovereign, self-hosted deployment reduce concentration risk and give supervisors something to inspect.

Written for the security, risk and data protection teams who have to evidence this — not just describe it.

Book a DemoCommon Questions
What it is

Digital Operational Resilience Act (DORA)

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) creates a uniform framework for the digital operational resilience of the EU financial sector. It requires financial entities to manage ICT risk, classify and report major ICT-related incidents, test their digital operational resilience, and manage the risks of ICT third-party providers — including concentration risk and contractual safeguards. Critical ICT third-party providers fall under a dedicated EU oversight regime. DORA has applied since January 2025.
At a glance
Jurisdiction
European Union
Applies to
Financial entities across the EU — banks, insurers, investment firms, payment and crypto-asset providers and others — and the ICT third-party providers that serve them.
Talk to us
How we help

How Scrydon helps you comply

Controls are built into the runtime, so compliance is something you can demonstrate with evidence drawn from the platform itself — not assembled after the fact.

ICT risk management by design

Fail-closed defaults, an mTLS service mesh and policy-as-code authorisation give you a resilient, least-privilege architecture for AI and data workloads. Controls are enforced consistently across the application and data planes, supporting the ICT risk-management framework DORA expects financial entities to operate.

Audit log and incident traceability

The immutable, queryable audit log captures actors, IPs and decisions with retention controls, providing the traceability needed to detect, classify, investigate and report major ICT-related incidents and to evidence resilience to supervisors and auditors.

Reducing third-party and concentration risk

Self-hosted and sovereign deployment means critical workloads need not depend on a single external hyperscaler, directly addressing DORA's concern with ICT third-party concentration risk. Opt-in external AI vendors keep the supply chain explicit and under your control.

Resilience testing and continuity

Because the platform can run within your own environment with reproducible, policy-governed configuration, you can include it in your digital operational resilience testing and continuity planning, exercising failover and recovery on infrastructure you control.

Framework evidence packs

Evidence packs map platform controls to DORA's resilience and ICT-risk themes alongside ISO 27001 and SOC 2, giving your risk, compliance and audit teams a documented starting point for register-of-information and oversight engagement.

Key requirements

What DORA asks of you

  • Operate a comprehensive ICT risk-management framework governed by the management body.
  • Detect, classify and report major ICT-related incidents within set timelines.
  • Carry out regular digital operational resilience testing.
  • Manage ICT third-party risk, including contractual safeguards and exit strategies.
  • Monitor and mitigate ICT concentration risk across critical providers.
  • Maintain a register of information on ICT third-party arrangements.
  • Share cyber-threat information and intelligence where appropriate.
Where the line sits

What we provide, and what stays yours

No vendor can be compliant on your behalf. We build the controls into the platform and produce the evidence; the assessment of your own deployment stays with you. Here is the split, stated plainly, so it does not surface late in a security review.

Scrydon provides

  • Controls enforced in the runtime by default, rather than left to configuration.
  • An immutable, queryable record of what ran, on whose authority, and against which data.
  • Evidence packs mapped to the obligations set out on this page.
  • Documented architecture and data flows your assessors can read.
  • Deployment inside your own perimeter — up to fully disconnected.

You remain responsible for

  • Classifying your own systems and data under the framework.
  • Your risk assessment, data protection impact assessment and conformity assessment.
  • Who you grant access to, and on what basis.
  • Your incident response and reporting obligations.
  • The operational security of the environment you run it in.
Our security postureRead the documentation
FAQ

Frequently asked questions

How does Scrydon support DORA compliance for financial entities?+
Scrydon provides the technical foundations DORA emphasises: a resilient, fail-closed, mTLS-secured architecture for ICT risk management, an immutable audit log for incident detection and reporting, and sovereign self-hosted deployment that reduces dependence on a single external provider. Evidence packs map these to DORA themes. We speak to alignment and the controls that help you meet your obligations; classifying incidents, reporting to your competent authority and your overall resilience programme remain your responsibility.
How does the platform reduce ICT third-party concentration risk?+
DORA is explicit about the systemic risk of over-reliance on a few ICT providers. Because Scrydon can be deployed in your own environment or sovereign infrastructure rather than locking critical workloads to a single hyperscaler, you can diversify and retain control of your most important AI and data systems. Opt-in external AI vendors keep any third-party dependency explicit and governable.
Does Scrydon help with major incident detection and reporting?+
The immutable, queryable audit log records actor, IP, decision and agent activity with retention controls, which supports detecting, classifying and investigating ICT-related incidents and assembling the information you need for regulatory reporting. The platform provides the traceability; the classification thresholds and notifications to your competent authority remain yours to operate.
Can Scrydon be part of our digital operational resilience testing?+
Yes. Because the platform runs with reproducible, policy-governed configuration on infrastructure you control, you can exercise failover, recovery and access controls as part of your resilience testing programme, and include it in scenario testing and continuity planning.
Is Scrydon a critical ICT third-party provider under DORA?+
Designation as a critical ICT third-party provider is made by the European Supervisory Authorities against defined criteria, not self-declared by a vendor. Regardless of designation, deploying Scrydon in a sovereign, self-hosted way keeps your most critical workloads under your direct control and helps you manage third-party risk under your DORA framework.

Related

Financial Services→AI Governance→All compliance frameworks→
Back to all compliance frameworks