ICT risk management
The management body owns a documented framework to identify, protect, detect, respond and recover, reviewed at least once a year.
Access, roles and MFA are checked all the time, with gaps surfaced as they appear.
Resilience you can show, not just describe.
The Digital Operational Resilience Act has applied since 17 January 2025 to financial entities in the EU, authorised CASPs included. It asks for a working ICT risk framework, fast incident reporting, regular testing and firm control of the technology providers you depend on.
Blockchain analytics · primaryProvider AHealthy
Blockchain analytics · standbyProvider BStandby
Reporting clock · INC-0042No incident
Classifiedmajor, 10:40Initialwithin 4hIntermediatewithin 72hFinalwithin 1 month
Classified as majorJ. Jansen
PersonInitial notification sentCase AI drafted · approved
AgentRegister of information updatedProvider B · failover
Engine17 Jan 2025
the date DORA began to apply, CASPs included
4h
to notify a major incident once it is classified, and no later than 24 hours after detection
0
pillars: risk, incidents, testing, third parties and information sharing
0 yrs
between threat-led penetration tests, for the firms selected
What DORA asks, and what Avus records.
DORA is about how your systems hold up. Avus is one of those systems, and it keeps the evidence for the rest.
Protection and prevention
Strong authentication, access limited to what each role needs, and logging of what happens on your systems.
Single sign-on and MFA, role-based access and an append-only log of every action.
Incident reporting
Major ICT incidents are classified against set criteria and reported on a fixed clock: an initial notification, an intermediate report and a final report.
Provider outages are logged with their timeline, ready for the report.
Resilience testing
A testing programme covers critical systems, with threat-led penetration testing every three years for the firms selected for it.
Failover to a second provider is set up and exercised, and every switch is recorded.
ICT third-party risk
Contracts with ICT providers need specific terms, and a register of information on every arrangement is kept and shared with the regulator.
An ICT third-party register with criticality, exit plans and review dates.
Exit strategies
Where a provider supports a critical or important function, a documented and tested exit plan must exist.
A provider-neutral data model, so a switch leaves your rules and history untouched.
Key dates.
DORA is fully in force. What remains is doing it well, every year.
- DORA enters into forceA two-year run-in begins for firms and supervisors.
- DORA appliesICT risk, incidents, testing and third-party rules take effect.
- First registers of informationEvery ICT third-party arrangement recorded and submitted.
- Critical providers designatedThe first critical ICT third-party providers come under EU oversight.
Resilience with the receipts.
Supervisors want to see that controls ran, when they ran and who looked.
Engine
Watches every connection
Latency, errors and failures on every provider are recorded as they happen.
Agent
Assembles the timeline
When something breaks, the events are pulled into one timeline for the report.
Person
Classifies and signs off
People decide whether an incident is major, and approve what goes to the regulator.
The rest of the rulebook.
Every regime writes to the same controls and the same record, so meeting one helps you evidence the others.
MiCA
Markets in Crypto-AssetsAuthorisation, governance and ongoing obligations, evidenced from day one.
Read moreAMLR
Anti-Money Laundering RegulationOne EU rulebook for due diligence and monitoring, applied the same way every time.
Read moreTravel Rule
Transfer of Funds RegulationOriginator and beneficiary data travels with every transfer and is checked before funds move.
Read moreEmirate of Dubai
Virtual Assets Regulatory AuthorityLicensing, a travel rule from AED 3,500 and AML records kept for eight years.
Read moreShow us your register.
We will map your providers into an ICT third-party register and show what an incident timeline looks like in Avus.
Sources
A summary to help you find your way, not legal advice. The official texts are the reference, and your own counsel should confirm how they apply to you.