Reference
Regulatory toggle catalog
The 16 regulatory feature toggles, each default-off and sticky once it first produces a regulated artifact.
There are 16 regulatory toggles. Every toggle defaults to off for a new tenant. A toggle becomes sticky -- it can no longer be switched off without a dual-approval request -- the moment it first produces the regulated artifact described under Becomes sticky when.
| Key | Group | Regulation | Becomes sticky when | Owner module |
|---|---|---|---|---|
dora_major_incident_classification | DORA | DORA Art. 18 | First incident classified as DORA major. | incident |
dora_major_incident_cascade | DORA | DORA Art. 19 | First initial notification dispatched (or drafted past 4h mark). | reporting |
dora_register_of_information | DORA | DORA Art. 28(3) | First Register of Information export generated. | reporting |
dora_detection_workflow | DORA | DORA Art. 10 | First critical-CVE detection event emitted. | cmdb, reporting |
dora_testing_notes | DORA | DORA Art. 25 | First Change tagged with DORA testing implication. | change |
dora_concentration_risk | DORA | DORA Art. 29 | First concentration-risk report generated. | reporting |
nis2_significant_incident_cascade | NIS-2 | NIS-2 Art. 23 | First NIS-2 early warning dispatched. | incident, reporting |
marisk_audit_retention_extended | MaRisk | MaRisk AT 4.3.1 | Activation alone counts as artifact (changes retention rules). | audit |
bait_berechtigungskonzept_export | BAIT | BAIT 5.4 | First Berechtigungskonzept export generated. | reporting |
bait_information_classification | BAIT | BAIT 4 | First CI tagged with data_classification other than default. | cmdb |
betrvg_works_council_view | BetrVG | BetrVG §87 | First Works Council member role assignment. | identity, pseudonymization |
eol_eos_risk_register | DORA | DORA Art. 8 | First CI past EoS appears on register. | cmdb, reporting |
cve_detection_ui | DORA | DORA Art. 10 precursor | First CVE manually entered on a CI. | cmdb |
idv_flag_for_applications | BAIT | BAIT 6 | First Application CI flagged is_idv = true. | cmdb |
sub_outsourcing_chain | DORA | DORA Art. 30 | First sub_outsourced_to relationship created. | cmdb |
gdpr_enhanced_data_export | GDPR | GDPR Art. 20 | First GDPR Article 20 export generated. | reporting |