Automate evidence that a machine can produce reliably: asset inventories, scan results, backup restore logs, alert timestamps and the register of ICT third party contracts. Keep humans on judgment calls such as incident classification and management body review. Each export should carry a date, a source and an owner.
DORA is Regulation (EU) 2022/2554. This post explains what the text implies and does not claim that any tool makes you compliant.
What evidence does each article imply?
The regulation does not publish an evidence checklist, so this is our reading of the articles.
Article 8 asks for inventories of ICT supported functions, assets and dependencies and a yearly assessment of legacy systems. The matching evidence is a dated inventory export.
Article 10 requires detection of anomalous activity with alert thresholds that are regularly tested. Evidence: the threshold configuration, test records and an alert log with acknowledgement times.
Article 12 requires backup policies and periodically tested restoration. Evidence: restore test logs with a date, system and result.
Article 17 asks for a process to record incidents with roles and communication procedures. Evidence: incident records with timestamps for detection, classification and each report.
Article 25 lists vulnerability assessments and scans, and open source analyses. Evidence: scan outputs with dates and findings by severity.
Article 28(3) requires a register of information on all contractual arrangements for ICT services, distinguishing those that support critical or important functions, reported to authorities at least yearly and provided in full on request.
What should be automated first?
Start where the output is already structured. A dependency inventory in SPDX or CycloneDX, a scan result and an alert log are data. Schedule them and store each run with its timestamp. The register of information is a spreadsheet problem, so keep it as structured records with fields for provider, service, function supported and contract dates, and generate the yearly report from it.
What should not be automated?
Classifying an incident as major is a judgment that starts the reporting clock. Let a person decide and record why. The same goes for accepting a risk, approving an exception and reviewing the framework with the management body. DORA recital 45 says the management body keeps ultimate responsibility, and a script cannot hold that.
How do you avoid fooling yourself?
Three traps come up with automated evidence.
Green dashboards without sources. A status badge is not evidence. Keep the raw export that produced it.
Evidence with no owner. Every artifact should name who reviewed it and when.
Coverage gaps. An automated scan of 80 percent of assets makes the missing 20 percent invisible. Report coverage next to results.
Tamper resistance also matters. Store exports in a place where edits are logged, and record a hash of each file so you can show it did not change after the fact.
What to do
- List the articles you must evidence and the artifact for each.
- Pick the five most repetitive artifacts and schedule them.
- Store every export with date, source system and reviewer name.
- Report coverage (assets scanned versus assets known) with each scan.
- Keep the incident classification and management review as recorded human decisions.
- Maintain the register of information as structured data and test a full export before you need it.
Quick check
Can software prove DORA compliance?
No. Software can produce and preserve evidence. Compliance is judged by your supervisor against the regulation.
What goes into the register of information?
Article 28(3) requires it to cover all contractual arrangements on the use of ICT services, with those supporting critical or important functions distinguished.
Sources
Last reviewed: 18 October 2026.
