Critical functions and CIFs
Scope, continuity objectives and function ownership.
DORA operational resilience
Connect critical functions, ICT risk, tests and providers. Before the supervisory review.
AuditReady keeps CIFs, ICT dependencies, incidents, resilience tests, third parties and findings in one operating context, with evidence and ownership attached.
workspace.auditready.eu/dora/resilience
DORA resilience
Payments CIF| Item | Owner | Status | Threshold / review |
|---|---|---|---|
| CIF — payment settlement | ICT Risk | Active | 30 Apr 2026 |
| Single cloud provider | Third-party oversight | In review | 22 Apr 2026 |
| Resilience test | Resilience lead | Open finding | 12 Apr 2026 |
| ICT incident — change | IT Operations | To attach | 6 Apr 2026 |
DORA resilience breaks when CIFs, providers and tests live in separate files.
- Critical functions, RTO/RPO and ICT dependencies sit in registers that do not share status.
- Third-party ICT evidence is split across legal, procurement and security.
- Resilience tests and ICT incidents stay in reports detached from findings.
- Ownership is reconstructed when a supervisory request arrives.
- Audit preparation starts again each cycle instead of consulting a continuous trail.
FinSecure demonstrative scenario
A realistic demonstrative scenario based on a payment institution with concentrated ICT dependencies.
Demonstrative organisation
FinSecure Payments S.p.A. — payment institution (demonstrative scenario)
Payments and white-label cards processor, dependent on one cloud provider, with resilience follow-up still open.
Current situation
Payment CIF defined; gaps on resilience testing and a single cloud provider.
What the scenario shows
This is not a real customer. In the demo you can follow a critical function from continuity thresholds to tests, findings and follow-up evidence.
What you can inspect
- Payment CIF with explicit RTO, RPO and MTPD.
- Cloud and ICT providers linked to the function.
- Resilience test with open follow-up findings.
- ICT change incident with evidence still to complete.
- Ownership and trail visible in the same scope.
Explore the FinSecure scenario
Opens the DORA demo environment. This is not a guided-demo request.
What changes in day-to-day work
Fragmented work
- Critical functions, RTO/RPO and ICT dependencies sit in registers that do not share status.
- Third-party ICT evidence is split across legal, procurement and security.
- Resilience tests and ICT incidents stay in reports detached from findings.
- Ownership is reconstructed when a supervisory request arrives.
- Audit preparation starts again each cycle instead of consulting a continuous trail.
Connected operating cycle
- Each CIF stays linked to continuity objectives, systems and the providers that support it.
- Incidents and tests open findings with an owner, a date and follow-up evidence.
- Third-party ICT evidence has status and version, not only an email attachment.
- The operating history remains available for internal review and supervision.
What the DORA module covers
ICT risk and dependencies
Systems and services linked to the context they support.
ICT incidents
Operational register with timeline, impact and supporting evidence.
Resilience tests and simulations
Outcomes and gaps kept in the CIF cycle.
ICT third-party providers
Contractual and documentary evidence with status and owner.
Findings and remediation
Follow-up assigned, dated and linked to closure proof.
Governance and accountability
Ownership on controls, tests and third parties.
Exports and Audit Day Pack
Packs for internal review and supervisory requests.
DORA module
Transparent pricing for this framework
The DORA module includes the platform, control catalogue, critical functions, ICT incidents, resilience tests, third-party providers and review preparation. Other frameworks stay on the full price list.
DORA
Piattaforma completa più catalogo controlli e contenuti DORA.
€ 690 / month
€ 6.900 / year Annual billing: 10 months paid, 2 months included
- Core loop: Audits and controls · Evidence and versions · Supplier evidence requests · Gap Snapshots · Exports and Audit Day Pack · Findings and remediation
- Operational governance: Inventory, policies and mapping · Attestations and entity profile · Incident simulations
- Operational registers: Risk register · ICT incidents, critical functions and tests
Request a DORA demo on your ICT scope.
We will walk through CIFs, third-party providers, tests and findings in one operating context.
Limitations
AuditReady does not replace ICT risk, regulatory advice or the organisation’s decisions. It makes DORA work traceable, verifiable and ready for review and supervision.