> For the complete documentation index, see [llms.txt](https://intuitem.gitbook.io/ciso-assistant/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://intuitem.gitbook.io/ciso-assistant/features/framework-specific/dora.md).

# DORA

Register of Information and structured incident reports for DORA compliance

The EU [Digital Operational Resilience Act](https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en) (DORA) imposes two specific reporting obligations that CISO Assistant produces out of the box: the **Register of Information** on ICT third-party arrangements, and structured **major incident reports** filed with the supervisory authority.

Both, and the DORA-specific fields they read from entities, solutions, assets and contracts, are gated by the **dora** [feature flag](/ciso-assistant/configuration/settings/feature-flags.md). It is **on** by default — organisations outside DORA's scope can turn it off to keep those fields off their forms.

## Register of Information (RoI)

DORA Article 28(3) requires regulated financial entities to maintain — and periodically submit — a register listing every ICT third-party service provider, the services consumed from each, the supporting contracts, and a number of classification fields.

CISO Assistant builds this register from the entities, solutions, and contracts you already track in the **third-party risk** module:

1. Open **Reports** → **DORA Register of Information**.
2. The page **lints** your data first — it flags missing fields the RoI requires (LEI codes, criticality classifications, contractual fields, …) so you can fix them before exporting.
3. Once the lint is clean, download the RoI in the official ESMA template format.

The lint pass is the part that pays for itself: filing an RoI with missing required fields means it gets rejected and you redo the work. Running the lint while the data is fresh in your hands is much cheaper.

## DORA incident reports

DORA Article 19 requires regulated entities to report **major ICT-related incidents** to the competent authority on a defined timeline (initial notification, intermediate report, final report). The notification template is prescriptive — specific fields, specific formats.

CISO Assistant ships a dedicated **DORA incident report** object:

* Created from an existing [incident](/ciso-assistant/concepts/operations/incidents.md), inheriting the operational data already captured there (timing, scope, affected entities).
* The form mirrors the official DORA fields and validates required content per report phase (initial, intermediate, final).
* Each report can be exported as JSON aligned with the authority's submission schema.
* New report phases can be created from an existing one (`new?from=…`), inheriting the prior phase's content as the starting point — the typical incident report grows over time as the picture clarifies.

The incident detail page links to its DORA reports; the DORA reports page links back to the source incident.

## Related

* [DORA on the EIOPA website](https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en)
* [Incidents concept](/ciso-assistant/concepts/operations/incidents.md)
* [Third-party risk concept](/ciso-assistant/concepts/specialised-modules/third-party-risk.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://intuitem.gitbook.io/ciso-assistant/features/framework-specific/dora.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.