Classification on proof
Each ICT incident classified against the DORA criteria with who decided and when.
ICT resilience you can prove.
Digital Operational Resilience Act
Banks, insurers, investment firms, payment institutions and crypto-asset service providers must prove digital resilience, report major ICT incidents within hours and keep their ICT suppliers on a short leash. Reltime runs it live.
Who it hits.
Around twenty types of EU financial entities, from banks and insurers to payment and e-money institutions, investment firms and crypto-asset service providers. ICT providers that serve them inherit the demands through contracts and audits.
What it demands.
- Art. 5–6An ICT risk management framework owned by the management body
- Art. 19Major ICT-related incidents classified and reported to the competent authority
- Art. 28A register of information covering every ICT third-party arrangement
- Art. 24–26Resilience testing, with threat-led penetration testing for significant entities
- 4 h
- Initial notification after classification, at the latest 24 h after detection
- 72 h
- Intermediate report
- 1 month
- Final report
Applies since 17 Jan 2025
What Reltime runs. In real time.
Hours become provable
Initial, intermediate and final reports drafted from the anchored timeline.
Register of information, live
Every ICT third-party arrangement and every change kept current and verifiable.
Changes held until approved
Changes to critical ICT services released only when the approval is anchored.
Testing evidence
Test scope, findings and remediation tied to owner and date.
RELTIME VERIFICATION RECEIPTExample
- Event
- ICT incident #2291 · major
- Classified by
- ops.risk.lead · verified
- Rule
- dora-classification v1.4
- Time
- 2026-10-14 09:05:12.874 CET
- Fingerprint
- c07d…1f3a · unchanged ✓
One receipt. Every auditor.
Who acted, which rule applied and whether anything changed. Created the second it happened. Verified by any authorised party without access to your systems.
Live in four weeks.
- Week 1
Map the incident process and connect the ITSM tool
- Week 2
Configure the rail, roles and alerts
- Week 3
Test with your counsel or auditor
- Week 4
Run in real time and deliver the first evidence pack