DORA Compliance
DORA Operating Layer:
Full regulatory automation
Most DORA tools stop at threat intelligence. Real DORA compliance demands operational proof across 6 layers — from CVE patches to board-level governance reports. Here's how FeedOracle + ToolOracle automate the full chain.
Published March 19, 2026 · 8 Oracles · 95 MCP tools · 49 DORA articles covered
DORA operating layer
FeedOracle + ToolOracle · 8 Oracles · 95 tools · all DORA articles covered
Governance & reporting10 tools
GovernanceOracle — board packs, framework review, KPIs, exceptions
Art. 5–6 · Management body · ICT risk framework · Annual review
Resilience & recovery10 tools
ResilienceOracle — BIA, RTO/RPO, DR tests, crisis plans, scenario library
Art. 11–12 · BCM · Response & recovery · Del. Reg. 2024/1774
Asset & dependency mapping10 tools
DependencyOracle — asset inventory, blast radius, SPOF, impact simulation
Art. 8 · ICT assets · Business functions · Dependencies
Register & contracts20 tools
RegisterOracle — RoI, ITS export, CTPP, concentration risk · ContractOracle — clause check, exit readiness, CIF analysis, red-flag scoring
Art. 28–30 · Register of Information · Contractual provisions · Subcontracting
Third-party risk & AML27 tools
DORAOracle · AMLOracle · InsuranceOracle — provider risk, sanctions, PEP, KYC, NatCat
Art. 28–44 · Third-party risk · AMLR · Insurance resilience
Threat intelligence & incident18 tools
DORAOracle — CVE/KEV, CERT-Bund, MITRE ATT&CK, breach check, incident timeline, TIBER-EU
Art. 6–10 · ICT risk · Art. 17–23 · Incidents · Art. 24–27 · Testing
FeedOracle: ES256K signing · Polygon + XRPL anchoring · verified PDF reports · 53 compliance MCP tools
GovernanceOracle — Art. 5–6
register_findinglist_findingsboard_reportframework_reviewcontrol_statusexception_registeraction_trackerkpi_dashboardannual_reviewhealth_check
Management body review packs, risk posture KPIs, exception tracking with expiry, remediation actions, annual framework review evidence — Art. 5(2), Art. 6(5), RTS 2024/1774
ResilienceOracle — Art. 11–12
register_systemset_biarto_rpo_checktest_registerscenario_librarybcm_gap_analysisrecovery_statuscrisis_plan_checkevidence_bundlehealth_check
BIA data collection, RTO/RPO validation, DR test registry, 10 DORA test scenarios, crisis communication plan checks — Art. 11(4–7), Del. Reg. 2024/1774
DependencyOracle — Art. 8
register_assetregister_functionmap_dependencydependency_graphblast_radiusspof_analysiscriticality_scoreasset_inventoryimpact_simulationhealth_check
ICT asset registry, business function mapping, dependency graphs, blast radius on outage, SPOF detection, cascade impact simulation — Art. 8(1–4)
RegisterOracle + ContractOracle — Art. 28–30
register_providervalidate_roiconcentration_riskctpp_checkexport_itsgap_analysisregister_contractclause_checkexit_readinesscif_analysiscontract_scoringsubcontracting_chain
Register of Information (ITS-compliant), CTPP designation scoring, concentration risk, all Art. 30 mandatory clauses (8 standard + 7 CIF), exit plan readiness, red-flag scoring — Art. 28(3), Art. 30(2–3)
DORAOracle + AMLOracle + InsuranceOracle — Art. 28–44
provider_riskcloud_statussanctions_screenpep_checkkyc_bundlewatchlist_updateadverse_medianatcat_liverisk_scoregleif_lookup
ICT provider risk assessment, live cloud outage monitoring (AWS/GCP/Azure), EU+OFAC+UN sanctions screening (87k names), PEP checks, KYC bundles, NatCat feeds, GLEIF lookup — Art. 28–44, AMLR
DORAOracle — Art. 6–27
cve_searchcve_latestkev_listkev_checkcert_advisoriesbreach_checkthreat_actorsincident_timelinemitre_techniquestlpt_scenariosdora_newsdora_calendar
NVD CVE search, CISA KEV patch deadlines, CERT-Bund advisories, HaveIBeenPwned, Feodo C2 tracker, DORA-compliant incident timelines, MITRE ATT&CK for TIBER-EU — Art. 6–10, 17–23, 24–27
Why most DORA tools only cover 1 of 6 layers
The majority of compliance vendors build vulnerability scanners and threat intelligence feeds — that's the bottom layer. It's necessary, but DORA demands much more: operational evidence across governance, resilience, dependencies, contracts, third-party risk, and threat management.
Without a RegisterOracle that produces ITS-compliant exports for supervisory reporting, without a ContractOracle that checks all 15 mandatory Art. 30 clauses, without a ResilienceOracle that validates RTO/RPO against actual capabilities — your DORA program is incomplete.
The evidence backbone: every claim verifiable
FeedOracle's cryptographic signing layer (ES256K / JWS RFC 7515) runs through all 6 layers. Every data point is signed, timestamped, and anchored on Polygon + XRPL. This isn't a feature — it's the foundation that makes every layer audit-ready.
When your BaFin examiner asks "show me your Register of Information validation from January," you don't search through spreadsheets. You pull the signed evidence bundle with a single API call.
Built for AI agents, not just humans
All 95 tools are exposed as MCP (Model Context Protocol) endpoints. AI compliance agents can discover, authenticate, and use them autonomously — no human in the loop needed for routine checks. The Agent $299/mo tier is designed specifically for this use case.
July 2026: 4 months remaining
DORA enforcement is not a gradual rollout. It's a binary deadline. Financial entities that can't demonstrate operational resilience across all pillars face supervisory action. The Register of Information (Art. 28) alone requires structured data on every ICT third-party relationship — most institutions are still managing this in spreadsheets.
This stack exists to close that gap.