The situation
The register of information does not fit in a spreadsheet
DORA requires financial entities to keep a register of information on their contractual arrangements with ICT third-party service providers, in a precise format, ready for submission to the competent authority. Most teams start in Excel: contradictory provider names, missing LEI codes, unchecked clauses, a file rejected on validation.
DORA Toolkit takes the regulatory template and its checks, imports your existing register and produces the export in the expected format. Governance, ICT risks, incidents, tests and contracts share one data model: a critical function reads back with its assets, its third parties, its contracts and its incidents.
The tool covers DORA and DORA only, for banks, insurers, fintechs, payment institutions and asset managers, and for consultants following several entities. The analysis remains your team’s; for the regulatory substance, our partners take over.
An imposed format
Fifteen tables defined by the European technical standards, from scope to nth-rank subcontractors.
A filing that gets rejected
A file in the expected format can still be refused on submission: missing LEI code, wrong classification, badly serialised EBA code. One inconsistency is enough.
Obligations to derive
Every contract, every provider, every critical function triggers its own obligations. Tracked by hand, some go unnoticed until the audit.
Use cases
Five situations DORA Toolkit was built for
Audit ahead
The supervisor asks for the register of information.
New CISO
No documented ICT framework on arrival.
Budget to defend
Justifying the ICT budget to management.
Incident to qualify
Knowing whether an outage is reportable, and when.
New entity
Bringing an acquisition into the DORA scope.
Register of information
The fifteen regulatory tables, fed by guided forms
- The fifteen tables of the register, from RT.01.01 (entity maintaining the register) to RT.99.01 (terminology), are filled in from dedicated forms: critical and important functions within the meaning of article 8, third parties, contracts, assets. Every field carries its regulatory code, down to the coded EBA values.
- You start from your current register: import of an Excel file, a CSV or a ZIP package in XBRL-CSV format. The XBRL-XML format is not supported.
- A banner states at all times whether the register is exportable, and counts the blocking points left: mandatory fields, duplicate codes, inconsistencies. The export produces an XBRL-CSV package in the EBA DORA 4.0 taxonomy format, from b_01.01 to b_99.01. Nothing is submitted automatically.
- An existing gap assessment or action plan in Excel or CSV can also be the starting point. The AI draws proposals from it (functions, providers, assets, incidents, tests, actions), and you tick the ones you keep. Nothing is saved without your approval.
Data enriched on entry
Company lookup by SIREN or by name
Company name, SIRET and NAF code, pre-filled from the French government company search API when you create the record of a third party or of the entity.
LEI resolution via GLEIF
The LEI code expected in the register is looked up in the public GLEIF database, with the legal name, country and status. A valid SIREN is enough to find it. If it is not found, you enter it yourself.
Public databases only
Data comes from data.gouv and GLEIF. No personal or confidential data is needed.
Obligations
The applicable obligations, derived from your contracts
- The list of obligations is generated from the declared third parties, contracts and functions, grouped by article, each with its trigger: this contract, with that provider, for that critical function.
- For each obligation, you rate the coverage (covered, partial, gap, not assessed) and add your notes. The status is declarative: it is your assessment, not an automated check.
- The dashboard calculates an overall score and a score per pillar: governance, ICT risk, incidents, testing, third parties. The screen says so itself: this score is not a certificate of compliance.
- Legal references display in detailed or simplified mode, depending on whether the reader is legal counsel or an operational lead. It is a display setting: the article-to-field mapping and the score calculation do not change.
- An AI assistant, still in beta, answers from your data (score, gaps, deadlines, incidents, providers, contracts, tests) and from a structured reference of the DORA articles. Its usage quota stays visible. The analysis remains that of the CISO, the DPO or legal counsel.
ICT risks
An ICT risk register wired to your reference data
- Every risk carries its category, its likelihood and impact from 1 to 5, its criticality, its status and its owner.
- A risk attaches to the reference data you already entered: the function, the asset, the third party or the contract concerned. Nothing is re-keyed.
- A likelihood and impact matrix gives the overall reading, the one management expects in committee.
- Every risk gets its action plan: status, horizon, due date, owner. Actions come up as priorities on the dashboard.
- This register serves internal oversight: it does not feed the register of information submitted to the authority.
On the dashboard
Dependency map
From a critical function, you walk down to the assets, third parties, contracts, incidents and gaps attached to it, without rebuilding the link by hand.
Concentration alert
When the same provider carries several key functions, the tool flags it. ICT concentration risk is an article 29 requirement: the alert makes it visible without manual analysis.
Group exposure
Providers are grouped by corporate group and by subcontracting chain, from the register of information. Concentration can also be read at consolidated level.
Oversight
Incidents, test calendar and a report for management
- Every incident is classified as major, significant or minor (article 18) from quantified criteria: clients and transactions affected, duration, geographical spread, critical services, data loss, reputational impact.
- Initial, intermediate and final notifications are tracked with a countdown, and an email alert goes out at half and then at 90% of the deadline. The tool prepares the structured declaration, as a JSON file you file yourself with the ACPR.
- A calendar covers the five expected types of test (articles 24 to 27): vulnerability assessment, penetration test, scenario-based test, business continuity test and TLPT. Each carries its frequency, which you can change (by default six months for vulnerabilities, one year for penetration, scenario and continuity tests, three years for TLPT), and an email alert goes out 30 days and then 7 days before the due date.
- Every test gets its findings, ranked from critical to low, a dated remediation plan and its reports as attachments. Overdue remediations come up on their own. A TLPT opens its own fields: simulated threat actor, provider and its accreditation, TIBER-EU reference.
- From the dashboard, a compliance report is generated as a PDF or a PowerPoint presentation: a cover with the entity and the score, a summary with the top three priorities, an analysis by pillar, ranked points of attention.
- Every creation, change, import or export is recorded in a log nobody can alter afterwards. It can be filtered, compares the state of third parties, contracts and functions between two dates, and exports to CSV. It is reserved for administrators and auditors, whose access is read-only.
Before you start
Gauge your DORA maturity in twenty questions
- Twenty questions, around five minutes, no account needed.
- Each question points to the DORA article behind it, so you see where the requirement comes from, not just your score.
- The result is a first estimate. It replaces neither a complete register of information nor a compliance audit, and the score changes once the register is filled in within the application.
Access and plans
A 14-day trial, then the Standard plan
Trial
Free, 14 days
Complete register with import, obligations and score, ICT risks, incidents, tests, PDF and PowerPoint report. AI is metered: 10 questions to the assistant, 2 contract analyses, 3 document imports. The XBRL-CSV export comes with a subscription.
Create an accountStandard
Pricing on request
Everything in the trial, AI without quotas, the XBRL-CSV export of the register, email support within 48 hours and regulatory updates.
Get in touchWhen the account is created, a six-step start-up checklist leads the way, from the organisation record to inviting a colleague, by way of the first critical function, provider, contract and due diligence. Allow two hours for the first structuring of the register, with your list of ICT third-party providers and contracts at hand. At the end of the trial, the account stays available in read-only mode.
Before you start
Frequently asked questions
Is the XBRL export sent to the ACPR automatically?
No. DORA Toolkit generates the XBRL-CSV package in the expected format. You review it, then file it yourself through the official channel, the ACPR OneGate portal or the channel of your competent authority. The regulatory submission stays in your hands.
Will the XBRL file be accepted by the OneGate portal?
The package follows the EBA DORA 4.0 taxonomy, and blocking checks run on mandatory fields before export. Acceptance remains the authority’s call: a first submission on the ACPR test environment is recommended before filing in production.
Does the AI assistant replace a DORA consultant?
No. It answers from your own data and from a structured reference of the DORA articles, to shed light on a requirement or find a gap. It never concludes that you are compliant without data to back it. It is still in beta and can be wrong: the analysis remains that of a CISO, a DPO or legal counsel.
Where is the data hosted?
In France, at OVHcloud and 3DS OUTSCALE, in data centres certified ISO 27001 and ISO 27701 and SecNumCloud qualified. Data is encrypted at rest and in transit, and each organisation has its own partitioned space.
Can I take my data with me if I leave?
Yes. The full project exports as JSON from the organisation settings, and the register as XBRL-CSV with a subscription.
Can a consultancy follow several clients?
Yes. A partner account creates up to ten client organisations and switches from one to another without signing in again. Beyond that, our team attaches the next ones.
What terms apply to the subscription?
The terms of use and the terms of sale are public and available online. They are accepted when the account is created, and the acceptance is timestamped with the version in force. Whenever the terms are updated, a fresh acceptance is requested: you always know which version binds you, and on what date you accepted it.
Where can I follow product changes?
The product changelog is inside the application, reserved for customer accounts: it details functional changes version by version. The API changelog is public on the API page, with the endpoints added and the quota changes.
What happens at the end of the 14-day trial?
The account switches to read-only: your data stays viewable, editing and saving are blocked. The Standard plan reopens them, together with the XBRL-CSV export of the register.
Does DORA Toolkit cover NIS2, ISO 27001 or HDS?
No. DORA Toolkit covers DORA only. To cover several frameworks at once, the Make IT Safe GRC platform is built for that.
The Make IT Safe suite