Bespoke software for the five pillars of the Digital Operational Resilience Act: ICT risk management, incident reporting within four hours, resilience testing, third-party register and threat intelligence sharing. We do not replace ProcessUnity or OneTrust for enterprise use. Instead, we build the layer that connects your core systems, your own risk model and your DNB or AFM reporting.
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) came into force on 17 January 2025 and affects almost every financial entity in the Netherlands: banks, insurers, investment firms, pension funds, payment institutions, credit rating agencies, asset managers and crypto-asset service providers. Critical ICT third-party service providers, such as major cloud providers, also fall under direct European supervision through a separate route. In the Netherlands, DNB and AFM supervise most entities.
Good enterprise platforms already exist for the wider GRC work: ProcessUnity, OneTrust, ServiceNow GRC, MetricStream, Diligent, LogicGate and Archer. If your organisation already uses one of these suites and it fits your needs, we advise you to keep using it. We have no wish to compete with these platforms, and we rarely recommend replacing a platform as a standalone solution for DORA.
What we do build is the custom layer that your existing GRC platform doesn't solve for your situation: a DORA register that connects to your ICT landscape and your own risk classification, an incident management flow that prepares the correct reporting to the competent authority within DORA's four-hour deadline, a third-party register with deep links to your procurement, contract and monitoring systems, and integration with core banking, investment administration or policy systems that a standard suite doesn't offer out of the box. We do this as an add-on to KYC/AML software where both projects run in parallel, or as a standalone building block within a broader risk management software project.
If your DORA project runs alongside obligations that rest on the product itself, it touches the Cyber Resilience Act. And because the reporting deadlines in both frameworks start the moment you become aware of something, vulnerability management is often the component that needs to come first.
Most projects start with one of these three and grow organically as the other pillars mature. In the first conversation, we advise which option will deliver the most value for your type of institution, your supervisory regime and your existing ICT landscape.
A central register of your ICT assets, critical business functions, supporting processes and their interdependencies, with a risk classification aligned to your own established policy. Includes a governance workflow for periodic review by the risk function, sign-off by the management board, and demonstrable logging for inspection by DNB or AFM. It does not replace your GRC suite, but it feeds that suite with data that is currently often scattered across spreadsheets and ticketing systems.
The software your security operations team uses once a major ICT-related incident has been classified: a case management environment that handles the incident, applies the DORA classification criteria (client impact, geographic spread, duration, data loss, reputational damage, economic impact), automatically prepares the initial, intermediate and final notification templates, and tracks the deadlines for DNB, AFM or the relevant ESA. Includes integration with your SIEM, ticketing system and the communication flows to clients and the press.
A complete third-party register that maps all outsourced ICT services: contracts, subcontractors, data flows, processing locations, exit strategies, criticality ratings and ongoing SLA monitoring. Includes due diligence workflows for new suppliers, periodic reassessments, and automatic alerts when a contract fails to meet DORA requirements or when measured availability falls short of the agreed level. Deeply integrated with procurement, contract management and monitoring systems for one consistent view.
If you are designated for an advanced resilience test, it comes with its own process, with a scope that the supervisor validates. For more on this, see our page on software for the TLPT process under DORA.
A production-ready DORA environment that connects to your existing GRC, security and core systems, plus everything around it so you can manage it yourself or have your IT partner manage it.
Four patterns we repeatedly see at institutions that approach us as a DORA implementation partner. If you recognise one of them, we would be glad to talk further.
You are a smaller or mid-sized financial entity, such as an investment firm, a payment institution, a crypto-asset service provider or a pension fund, for whom enterprise governance and compliance platforms are too costly and complex. A bespoke, leaner DORA environment is often more efficient than a suite where you use 80 per cent of the features yet still pay annual licence fees for all of them.
Your ICT assets sit in a CMDB, critical business functions in a Visio diagram, suppliers in an Excel procurement list, incidents in the ticketing system and risk acceptances in a SharePoint folder. Nobody has one complete picture that aligns with DORA requirements. A custom layer that connects these sources and feeds the DORA register from the systems where the truth lives prevents duplicate administration.
The off-the-shelf solution applies the same DORA classification criteria to a major bank and a specialist asset manager alike. As a CISO or risk officer, you know your critical functions have a different profile from that default assumption. Your own rules engine, in which you can configure criticality, impact and geographical factors, and which you can justify to DNB, produces better-founded classifications.
For incident detection and SLA monitoring, a hard-wired feed from your core banking, policy or investment administration system is essential. A standard SaaS product sits apart from your core landscape and only flags issues when someone enters them manually. Custom software lets the DORA system read the transaction and availability streams in real time, so a major incident is classified within minutes rather than hours.
A conversation in which we understand which supervision you fall under (DNB, AFM or an ESA as a critical third party), which GRC and security tools you use today, which core systems are in place, and where the current flow falls short of DORA requirements. We also map which integrations are needed with core banking, policy administration, your SIEM and your procurement and contract management. That way we already know, before the scope workshop, which smart API integrations will be part of the project.
A workshop with the CISO, risk officer, compliance officer and procurement function, plus interviews with the people who currently handle ICT risk and third-party work. We map the current process flows and measure them against the five DORA pillars and the Regulatory Technical Standards. We identify where your existing GRC platform is sufficient and where bespoke development adds value. At the end you have a concrete scope, a sprint plan and an initial screen flow for the DORA register or incident management.
We work in two-weekly sprints and deliver a working, testable version at the end of each one. The CISO or a delegated owner acts as product owner, and a board member or CRO as sponsor. Early in the project we test incident management through a tabletop exercise based on a realistic scenario, such as a SaaS supplier outage or a ransomware attack, so we can see where the flow breaks down before the first real four-hour notification arrives. A first pillar is ready after a few sprints; a full DORA implementation across all five pillars runs over a project spanning several sprints.
A phased rollout to the risk and compliance function, running in parallel with the existing process so no incident or supplier review is missed. Training for key users and a short video introduction for suppliers who supply data themselves via the third-party portal. From go-live we provide monitoring, security patches, integration upkeep and further development based on new RTS publications, ITS updates or changes in Joint Examination practice. For every new guideline or supervisory update, we handle the impact analysis and the adjustment.
The questions CISOs, risk officers and compliance officers most often ask us when a DORA project begins.
A thirty-minute introductory call, with no obligation. We listen to which supervision you fall under, which GRC, security and core systems you have in place and where the friction lies, and we give direction you can use straight away, even if we ultimately don't work together.
Appfront uses cookies and similar technologies to keep the website working properly, for analytics and for marketing. You choose what you allow. Read more in our privacy policy.
