ProductsModulesPricingBlogAbout PL Log in See demo
Module / DORA

DORA. Operational resilience for your financial entity.

Regulation 2022/2554 (DORA) came into force in January 2025. All ICT contracts must have consistent RTO/RPO, critical vendors must be registered with the Polish FSA (KNF). Do it here instead of three spreadsheets.

01 / ICT Vendor Register

Criticality classification + concentration risk.

Every vendor providing a critical function requires separate DORA categorisation. Concentration risk triggers when >25% of functions rely on a single provider. Mapping to FunctionRegister + list ready to submit to the Polish FSA (KNF).

  • CRITClassification per critical function
  • CONCAlert when >25% with one provider
  • KNFRegister in SPR-PF-18 format
02 / Contracts with RTO/RPO

Automatic RTO mismatch detection.

Every ICT contract carries an RTO/RPO. Every business process has a BIA with a required RTO. When the contract RTO exceeds the BIA RTO, signal DORA-001 fires. Negotiate or consciously accept with risk owner approval.

  • BIABusiness Impact Analysis per process
  • CONTRACTRTO/RPO in contract SLA
  • MISMATCHAuto-signal when contract > BIA
03 / Resilience Testing

TLPT, scenarios, RACI for incidents.

TLPT (Threat-Led Penetration Testing) is required for Significant institutions. Test scenarios: data center outage, cyber attack, supplier failure. Each scenario has a RACI, BCP and post-mortem.

  • TLPTAnnual Threat-Led Penetration Testing
  • BCPBusiness Continuity Plan per scenario
  • POST-MORTEMAction items with deadlines
04 / SPR-PF-18 Export to KNF

Generated document compliant with KNF technical standards.

Single Public Register / Standardised Reporting (KNF) format. XLSX + PDF ready to submit. Every change in the vendor register generates an update.

  • FORMATXLSX + PDF compliant with KNF
  • CHANGESDiff against previous version
FAQ

Najczęstsze pytania

Financial entities in the EU: banks, investment firms, payment and e-money institutions, insurance and reinsurance undertakings, and key third-party ICT providers to that sector. DORA has applied since 17 January 2025.
DORA requires maintaining a register of ICT contracts with classification of critical functions and reporting it to the supervisory authority. RealSec maintains the register, calculates concentration risk, and generates an export in the format required by the Polish FSA (KNF) (SPR-PF-18).
An RTO mismatch occurs when the recovery time objective (RTO) in a vendor contract is longer than the RTO derived from the Business Impact Analysis (BIA) of the process that vendor supports. RealSec detects this inconsistency automatically and generates signal DORA-001.
Supervisory authorities may impose periodic penalty payments (up to 1% of average daily worldwide turnover per day of infringement) and supervisory measures, including remediation requirements for critical providers.
Yes. Instead of three spreadsheets (vendors, contracts, incidents) you have one engine where data is not duplicated, and changes automatically recalculate risk, deadlines, and signals.

DORA without three spreadsheets.

Demo on real data: we will show concentration risk, RTO mismatch detection, and export to the Polish FSA (KNF).

Umów demo →