File your DORA initial notification inside the 4-hour window — from the incident your team is already working.

Incidents are scored against the seven RTS criteria as they are worked. Classification is embedded in the incident form, not a separate process.

Initial notification within 4 hours, intermediate report within 72 hours, final report within 30 business days. Timers start automatically when an incident is classified as major. The compliance officer who files each report cannot be the one who ran the incident response — segregation of duties.

Export the register of all ICT third-party service providers in the format expected by competent authorities. Data is sourced from the CMDB and integration catalog.

Identify dependencies on single ICT providers across business functions using CMDB relationships. Validate that each critical-function CI links to at least one supplier and contract, and surface concentration before the auditor asks.

CVE tracking on CIs linked to business-critical functions, with the detection trail and the full CVE-to-patch-to-change-to-closure remediation chain for Art. 10 resilience testing.

Change records carry test evidence, CAB approval chains with segregation of duties, and rollback documentation — linked to the CIs affected.