16 docs tagged with "dora"

The Manual's requirements that apply under context CTX-DORA, by level and grade, with each floor that the regime elevates and its legal basis.

Analysis of how SbD-ToE covers the technical requirements of Regulation (EU) 2022/2554 (DORA)

Cross-cutting map of the secure development process for systems with AI agents — from mandate to kill-switch, with stops in each SbD-ToE chapter and a cross-reference to the AI Act, NIS2, DORA and the CRA

Example incident reporting template aligned with the DORA RTS/ITS

Specifics of exception management in the context of monitoring and operations - alert silencing, log retention and regulatory implications

Framing of the normative analysis chapter, which shows how SbD-ToE intersects with different normative instruments and regulations

Organisational policy that defines the requirements for integration between security monitoring and the incident response process (IRP), including activation criteria, mandatory playbooks, response phases, regulatory notification, post-mortem and periodic testing, proportional to the criticality level (L1, L2, L3).

The hard core of practices that every application must meet, regardless of risk level

Cross-referencing SbD-ToE with the AI Act, CRA, DORA, NIS2, GDPR — with the MCP (canon and indexed cross-checks) and the web manual for content later than the snapshot.

The DORA & NIS2 convergence note is a single note for both sections and lives in the NIS2 section; this page points to it.

Guidance for organisations potentially within the scope of both DORA and NIS2

The 17 roles involved in implementing SbD-ToE, with responsibilities mapped to the technical chapters and regulations (NIS2, DORA, GDPR)

Practical roadmap for implementing SbD-ToE in line with DORA requirements - direct mapping of articles to actions

Organisational policy that defines the security requirements applicable to the contractual lifecycle with suppliers and contractors, including pre-contractual due diligence, minimum contractual clauses by risk level, technical onboarding, compliance monitoring, periodic reassessment and secure offboarding, proportional to the criticality level (L1, L2, L3).

Reusable templates and practical examples for implementing SbD-ToE principles in any normative framework

Technical and governance preconditions for Threat-Led Penetration Testing (TLPT) in a DORA context, and how SbD-ToE supports the preparation and baseline documentation for regulatory attestation.