Speed with control
Automate intake, assessment, and monitoring with guardrails that keep your policies in force.
ReportThe 2026 State of TPRMThe 2026 State of TPRM: where programs break and what risk leaders want insteadDownload
DORA made the ICT third parties behind your firm a board-level problem. Coverbase helps you manage them.
The Digital Operational Resilience Act has applied to EU financial entities since January 2025. It expects a real ICT third-party risk framework, a register of every provider arrangement, and incident reporting on a tight clock. Coverbase gives you the inventory, oversight, and evidence to run it.
CoverbaseDORA | ICT arrangement
DORA | ICT arrangement
The service behind the function
ICT service
Critical-function tag
Contract terms
Agent work
01Connect the provider
02Check the dependency
03Route a change
Arrangement ready for review
Your team maps the prescribed register fields.
Who DORA applies to
DORA (Regulation (EU) 2022/2554) is an EU regulation that applies directly across all member states. It covers about 20 categories of financial entities, from banks and payment firms to investment firms, insurers, and crypto-asset service providers, plus the ICT third-party providers that serve them. It has applied since January 17, 2025.
What DORA asks of you
- 01
An ICT third-party risk framework
Treat reliance on ICT providers as part of your overall risk management, with diligence proportional to how critical the service is. - 02
A register of information
Maintain a complete register of every contractual arrangement with ICT third-party providers, ready to report to your competent authority. - 03
Contractual safeguards
Provider contracts must cover service levels, data access and recovery, audit rights, subcontracting, and exit, with stricter terms for critical or important functions. - 04
Major incident reporting on a clock
Classify and report major ICT-related incidents fast: an initial notification within 4 hours of classifying an incident as major (no later than 24 hours after detection), an intermediate report within 72 hours, and a final report within a month.
Run your ICT third-party risk program in one place
DORA rewards organizations that can show their work. Coverbase keeps the inventory, diligence, and evidence current so you're not rebuilding it for every authority request.
Register-ready inventory
Keep a structured, exportable record of every ICT provider arrangement and the function it supports.Diligence, automated
Gather and review provider security and resilience evidence automatically, scaled to how critical the service is.Contract terms tracked
Capture the DORA-relevant clauses (audit rights, subcontracting, exit) and flag what's missing.Concentration and nth-party view
See where you depend on the same critical providers, and the fourth parties sitting behind them.
One platform for third-party risk and security
Explain with confidence
AI shows its reasoning for each recommendation, so you can explain your ratings and findings.
Automate with assurance
Adapt controls and workflows as your program and its regulations change.
How we protect your data
These are the practices behind the supplier records and evidence you keep in Coverbase. Read our security and privacy program.
To request our SOC 2 report or report a vulnerability, email security@coverbase.ai.
Independent review
A SOC 2 Type II audit against the AICPA Trust Services Criteria for security, availability, and confidentiality.Testing and remediation
External penetration tests every year, plus vulnerability scans and static and dynamic application security tests, with findings tracked through remediation.Identity and production access
SSO and SAML with Okta, Microsoft Entra, Google, and other identity providers. Multi-factor authentication is required for production access.Data protection
Data encrypted at rest with AES-256 and in transit with TLS 1.2 or higher.Internal accountability
Access logging, quarterly least-privilege reviews, and required employee security and privacy training.
DORA register questions
The reporting format is a separate job from the supplier review.
Does Coverbase produce the ESA register?
We bring the ICT service, provider, contract, and review evidence into the supplier record. Your reporting team maps the prescribed ESA fields and submits the register to its authority.
Does DORA cover every vendor?
Article 28 addresses ICT service arrangements. Classify the service first; a general purchasing list is not the same as the ICT register.
Who decides if a function is critical or important?
Your financial entity makes that classification under DORA and applies it to the arrangement. We keep the tag visible through the contract and review.