For regulated compliance teams

Turn regulatory obligations into evidence-backed assurance.

Structure assessments across frameworks, bind evidence to the specific obligations it supports, and record accountable approvals against each conclusion — so audit and regulatory review start from a prepared record rather than a reconstruction. The DORA cockpit on the overview page is one applied scenario of what you'll see here.

Request a demo See a simulated walkthrough →

What regulated compliance tell us

The submission goes in. The questions come back.

Preparation is often one project. Supervisory follow-up is often another. Four frictions recur across DORA, NIS2 and ISO 27001 programmes.

Evidence not bound to specific obligations

Documents and system records exist, but the link to the specific article or control they support is informal. When the regulator asks, the team re-establishes the link under time pressure.

Framework overlap is handled by hand

The same evidence often supports DORA, NIS2, ISO 27001 and internal controls. Without a mapping, the same work is repeated per framework and inconsistencies creep in.

Approvals are hard to retrieve later

Risk committee minutes, CRO sign-off, delegation chains — all exist, often in separate systems. Pulling them back together for a supervisory query is itself a project.

Submissions and audits start from a reconstruction

Each regulatory submission or audit cycle rebuilds the picture of what was decided and on what basis. The institutional record exists in people, not in a connected view.

Simulated use case

From DORA obligations to a regulator follow-up — one connected record.

Follow a regulated bank's compliance team from scope through to a supervisor's post-submission question. The scenario below shows DORA; the same workflow applies to UK NIS and NIS2 programmes, and across Tier 1, Tier 2 and Tier 3 banks. Illustrative, with synthetic data representative of the shape and detail CWORT records.

Simulated use case

DORA ICT Risk Management (Articles 5–15)

Organisation:Regulated bank (illustrative · Tier 1 / 2 / 3)Framework:DORA EU 2022/2554Scope:Chapter II · Articles 5–15Also applies to:UK NIS · NIS2Supervisor:Lead national regulator

1
Scope — DORA obligations decomposed
DORA Chapter II (Articles 5–15) is decomposed into 32 control activities. Each activity is mapped to the internal risk framework and ISO 27001 for reuse. The mapping is explicit, versioned and bound to the regulatory source text.
Scope established
Framework
DORA — EU 2022/2554
Articles
5–15 (ICT risk management)
Control activities
32
Internal mapping
Risk framework + ISO 27001 Annex A
2
Evidence capture per obligation
Technical teams submit evidence per obligation: policy documents, system configurations, test results, independent review logs. Each item is bound to the specific DORA article it supports — not stored as a general file attachment.
Evidence binding
Obligation
Article 9(2) — Protection and prevention
Evidence items
7 (policy, config, test result, review log, ×3)
Submitted by
ICT Security team
Bound to
Article 9(2) · Internal control CT-09
3
Risk committee validation
The ICT Risk Committee reviews evidence sufficiency per obligation and records judgement on control effectiveness with reasoning. The committee's judgement is captured against the committee as a body, not just as a meeting minute.
Committee judgement
Committee
ICT Risk Committee
Session date
2026-07-14
Judgement
Article 9(2) — Effective
Reasoning
"Evidence covers all four control objectives; test results current within 90 days."
4
CRO approval under separation of duties
The Chief Risk Officer approves the overall DORA posture. CWORT enforces separation of duties — the CRO cannot approve controls they operate. The approval carries role, timestamp and authorisation context (including delegated authority).
Approval recorded
Approver
Chief Risk Officer
SoD check
Passnot operational owner
Authorisation
Delegated under Board resolution 2026-04
Approved items
32 control activities · Articles 5–15
5
Regulatory submission generated
The submission is drawn from the live record. Each conclusion is backed by its linked evidence and approval chain. The submission is traceable obligation-by-obligation — the regulator does not just receive a report, they receive a report that references the record behind it.
Submission issued
Submission
DORA ICT Risk return · 2026-H2
Articles covered
5–15
Linked evidence
213 items, obligation-by-obligation
Approval chain
Complete per obligation
6
Six months later — the supervisor queries Article 9
The lead national regulator asks for the control effectiveness evidence behind Article 9. The team opens the record and returns the original evidence items, the risk committee's judgement, and the CRO approval in the same connected view — prepared from the existing record, not reconstructed.
Supervisory response
Query
Article 9 — control effectiveness evidence
Retrieved
7 evidence items + risk committee judgement + CRO approval
Response
Prepared from existing record
Reconstruction required
None

What this means commercially

Evidence-backed. Framework-mapped. Audit-ready.

Evidence-backed control assessments

Each conclusion is anchored to the evidence that supports it, bound to the specific obligation. Not a general file store — a record built for review.

Accountable approvals per obligation

Risk committee judgement, CRO approval and the delegation chain are recorded with role, context and timestamp. SoD is enforced at the approval boundary.

Improved audit and regulatory readiness

Supervisory follow-ups and audit cycles start from a prepared record rather than a reconstruction. The response is already there, not built under deadline.

Framework-mapped across DORA, NIS2, ISO 27001

Overlapping obligations share evidence and judgement where appropriate, with explicit mapping. The same work covers more frameworks without inconsistency.

Other audiences