See what you actually expose
Continuous discovery flags new subdomains daily, and your scans record their services and certificates in one asset register. DORA expects you to keep that inventory current.
DORA Art. 8DORA compliance software with audit-grade evidence built in
The Digital Operational Resilience Act (DORA) expects a documented vulnerability management programme, regular resilience testing, and proof of remediation. Vornin scans, auto-maps each finding against DORA, and creates a tamper-evident record chain, for financial entities and their ICT suppliers alike.
Read-only access Working scan data deleted after each scan EU-hosted
The problem
Compliance isn't the hard part. Proving it is
DORA calls it ICT risk management; your team calls it staying secure and proving it on demand. The controls are the doable part. The hard part is an audit trail that still holds up when an assessor asks whether the records were edited after the fact.
Who Vornin is for
Built for the teams who have to show their work
Vornin fits some teams better than others. Financial entities and their ICT suppliers in DORA scope are the core fit.
A fit if you are
- An in-scope financial entity answering its regulator (the competent authority under DORA): a bank, insurer, payment or e-money firm, investment firm, or crypto-asset service provider. Vornin maps each finding to the DORA article it supports and keeps the evidence current.
- An ICT supplier whose financial-entity customers push DORA obligations down by contract. Vornin produces the audit-ready evidence pack their vendor reviews ask for.
- A lean IT or security team that has to prove a vulnerability management programme exists, not just a scan now and then. Vornin runs it continuously and records the proof.
- Looking for EU-hosted tooling. DORA requires your ICT contracts to state where services run and where data is processed and stored. Vornin is EU-hosted, so that answer is short.
Not the right fit yet if
- You need threat-led penetration testing. TLPT under Article 26 is a specialist engagement. Vornin provides vulnerability scanning and evidence for the wider testing programme.
- You are outside DORA scope with no financial-entity customers asking for evidence. Vornin covers other compliance frameworks such as NIS2 or ISO 27001.
- You want a consultancy to run the programme for you. Vornin is the tooling your team operates, not a managed compliance service.
- You require on-premise or self-hosted deployment. Vornin is created and hosted in the EU, an EU platform by design.
How it works
Four jobs DORA needs done. One platform
Keep asset discovery, resilience-testing evidence, control mapping, and tamper-evident proof in one workflow. Each supports part of your DORA programme.
Test on a schedule, not once a year
Scans of web apps, APIs, networks, code and containers run daily, weekly or monthly. Vornin deduplicates findings, tracks SLAs, re-tests network and web fixes and compares each scan with the last.
DORA Art. 25 + RTS 10(2)Map every finding to the article it touches
Each result is tied to the DORA control it answers, alongside eight other frameworks, from a single scan.
DORA Art. 7-9, 25 + RTS 10(2)Give assessors verifiable records
Keep status changes in a tamper-evident history, with verification results your assessor can review alongside the remediation evidence.
Supports DORA Art. 6The workflow
Two audiences, one programme, one evidence trail
A regulator's request and a customer's vendor review run the same pipeline and land as the same audit-ready evidence.
Who feeds it
Financial entityIn DORA scope, answering a regulator.
ICT supplierPulled in by a customer's vendor review.
Vornin
01 Scan every surface
02 Map to the article
03 Seal the record
What comes out
Auditor packPer-finding ZIP plus tenant-wide PDF.
Compliance scoreLive, with a named coverage-gap report.
Verifiable chainSHA-256, re-checkable on demand.
Named in the law. DORA Article 25 names vulnerability assessments and scans directly.
Tamper-evident. Every status change is hashed into a SHA-256 chain you can re-verify.
One scan, nine frameworks. DORA, NIS2, ISO 27001 and six more from the same finding.
EU-hosted, read-only. Working scan data is deleted after each scan.
Control map
DORA articles, mapped to what an assessor sees
Read from the law outward: the DORA article first, then the control Vornin runs, then the artefact an assessor receives. Article 25 even names vulnerability assessments and scans directly, so the scanning is in the text, not our interpretation. DORA (Regulation (EU) 2022/2554) sets the duties. Its regulatory technical standard (RTS) 2024/1774 sets the detailed ICT risk rules, including weekly scanning. Rows marked "RTS" cite the standard.
| DORA requirement | What Vornin runs | Evidence it produces |
|---|---|---|
| Art. 7ICT systems, protocols and tools | Find outdated and exposed components. Port, DNS, dependency, container image and cloud posture scans, plus end-of-life detection for runtimes and base images. | Findings on outdated or exposed systems, with remediation deadlines. |
| Art. 8Identification of ICT risk | Find exposed assets. Continuous attack surface discovery checks for new subdomains daily and records the services, certificates and technologies your scans detect. Every finding also counts as continuous vulnerability assessment (Art. 8(2)). | ICT asset inventory that never silently drops a tracked host. |
| Art. 9Protection and prevention | Catch weak encryption, exposed secrets and access flaws before an assessor does. SSL/TLS scanning for weak ciphers, deprecated protocols, expiring certificates, and missing HSTS, plus secret scanning, unauthenticated API endpoint checks and cloud posture checks. | Encryption findings with severity and remediation deadlines. |
| Art. 24Testing programme, by attestation | You own the programme. Vornin supplies the test records behind it. | Your attestation, supported by scan history and remediation records. |
| Art. 25Testing of ICT tools and systems | Daily, weekly or monthly vulnerability scans, network security assessments (port, TLS, DNS), open-source analysis (dependencies, container images) and source code reviews (SAST, secrets). Includes deduplication, SLA tracking and scan-to-scan comparison. | Per-finding auditor pack ZIP plus comparison reports showing testing recurs. |
| RTS Art. 10(2)Weekly scanning of critical-function assets | Mark assets that support a critical or important function and configure their weekly scan schedule. The DORA control fails if a marked asset is not scanned weekly. | Scan cadence per asset, on the control and in the auditor pack. |
| RTS Art. 10(2)(d)Third-party and open-source libraries | Show how you manage dependency risk. Dependency scanning with reachability ranking, plus a CycloneDX software bill of materials. | CycloneDX SBOM export and dependency findings with remediation deadlines. |
| Art. 5–6Framework effectiveness, by attestation | Show the programme works, not just that it exists. Live per-framework compliance score, a 90-day trend, and a coverage-gap report naming untested controls. | Quarterly management-review report with a sign-off block, plus the score and gap report. |
| Art. 6(6)Internal audit of the ICT risk framework, by attestation | Keep finding history ready for review. Record status changes in a tamper-evident history with on-demand verification. | Per-finding ZIP with finding history, remediation evidence, and verification results. |
The governance, incident-reporting, and third-party contractual controls are organisational, not scanner-testable. Vornin tracks those through the manual attestation workflow with sign-off history and keeps them out of the auto-tested score, so what you put in front of an assessor is verifiable. Read the full DORA compliance guide →
The artefact
Proof you can hand over. And they can re-check it
DORA evidence has to survive scrutiny, from a regulator, an internal ICT audit, or a customer checking its suppliers. Every artefact below comes from the same scan data, hosted in the EU.
- History
What was tested, and when
Date-stamped scan history shows what was tested and when. Export the record for your resilience-testing review without reconstructing past activity.
- Chain
Tamper-evident by default
Review status changes in a tamper-evident history with SHA-256 verification. The verification result is included in the auditor pack alongside the finding evidence.
- Pack
One ZIP per finding
The per-finding ZIP carries the scan output, the full status history, the remediation log, the compliance mappings, and the chain-verification result. That is the artefact an assessor opens.
- PDF
One PDF for the whole estate
A tenant-wide auditor PDF renders every chain into a single programme summary for an external assessor or a customer's vendor review. Business and above.
- Mapping
Cross-referenced to DORA
A
compliance-mappings.jsonexport ties each finding to the DORA article it touches, alongside the eight other frameworks Vornin maps from the same finding.
Every plan records finding history. Business and Scale add auditor ZIP/PDF exports. Attestation tracking starts on Team. Compare tiers →
Questions buyers ask
DORA, answered
The questions that decide whether a tool counts when a financial entity or its ICT supplier scopes DORA.
Who does DORA apply to, and does it reach us as a supplier?
DORA applies directly to roughly 20 categories of EU financial entity: banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers, and more. It also reaches ICT third-party service providers: if you sell software or cloud services to a regulated financial entity, it must manage its ICT third-party risk and put DORA's contract terms in place (Articles 28 and 30), so its obligations flow down to you by contract. So this page speaks to two audiences, the financial entity answering a regulator and the supplier answering a financial-entity customer.
What is the difference between DORA and NIS2?
DORA is sector-specific to financial services and overrides NIS2 where the two overlap for in-scope financial entities, under the lex specialis principle. NIS2 is broader and covers 18 sectors. The vulnerability management controls are similar, so one scanning and evidence programme can serve both. Vornin maps findings to DORA and NIS2 from the same scan data.
Does DORA require penetration testing?
Article 25 includes penetration testing among the tests selected for a risk-based resilience-testing programme. Article 26 adds threat-led penetration testing for financial entities identified by their competent authority, normally at least every three years. Vornin provides scheduled vulnerability assessments and scanning evidence; it does not replace penetration testing or TLPT engagements.
What counts as evidence for a DORA ICT risk assessment?
Keep dated records of what was scanned, what was found, what action was taken, and whether a fix was confirmed. Vornin brings finding history and supporting evidence into an auditor pack, with a tamper-evident verification result your assessor can review.
Does DORA apply to SaaS and cloud suppliers?
Yes, if you supply ICT services to in-scope financial entities. DORA calls you an ICT third-party service provider (Article 3(19)), and your customers must manage that relationship under Articles 28 to 30, so they push the requirements down through contracts, security questionnaires, and proof-of-remediation requests, often before a deal closes. DORA's ICT risk-management standard also has them verify how you handle vulnerabilities and that you report at least the critical ones, with statistics and trends. A per-finding auditor pack and a management-review report answer those requests instead of stalling the deal.
Is there a DORA compliance certification?
No formal DORA certification exists. Compliance is demonstrated through an ICT risk-management framework, resilience-testing evidence, and documentation that a competent authority such as BaFin or the Central Bank of Ireland can request. So the question is not whether you are certified, it is whether you can produce the evidence on demand. That is what Vornin keeps current.
Every plan records finding history. Business and Scale add auditor ZIP/PDF exports. Attestation tracking starts on Team. Compare tiers →
Scan. Resolve. Prove.
Start your DORA evidence trail today
Evidence your DORA testing and remediation. Vornin maps every finding to the ICT-risk and resilience-testing control it touches and exports tamper-evident audit evidence. Every scan from day one becomes part of the trail.
Read-only access Working scan data deleted after each scan EU-hosted