Your DORA register and NIS2 posture, from the configs you already run.
The Digital Operational Resilience Act and NIS2 both want evidence you can produce on demand — not a binder you rebuild every quarter. Upload your firewall, cloud and identity exports and CyberTwin builds your DORA ICT-risk register, scores your NIS2 and GDPR posture, and reconciles the DORA, NIS2, GDPR, US-state and SEC notification clocks on one board — every control labeled proven or modeled.
Digital Operational Resilience Act — ICT risk management for EU financial entities.
The expanded network + information security directive for essential/important entities.
The data-protection regime whose breach clock reconciles alongside DORA + NIS2.
The management-system backbone most EU programs map their controls onto.
The UK baseline, scored alongside the EU set for cross-border programs.
Part of the 24 frameworks CyberTwin scores. Every control is labeled proven from your config or modeled from a crosswalk — a score built only on derived mappings is capped, because a crosswalk never masquerades as an audit.
The documents you hand the regulator.
A reality-check of your DORA ICT-risk register against your uploaded artifacts and dependency evidence — it shows where your register is covered and where the gaps are, an on-demand evidence base rather than a spreadsheet you maintain by hand. Coverage you can hand to counsel — not a filing, and not a certification.
WHICH PLAN SHIPS WHICH REPORTDORA, NIS2, GDPR, US-state and SEC notification deadlines on one cited board, so an incident’s clocks are never tracked in five places.
THE SEC / DORA / NIS2 CLOCKYour posture on the day the board signs off, frozen in one file: the score and framework coverage for each environment, the uploads it rests on and how fresh they were, which of network, identity, cloud, data, OT and AI were covered, and a plain flag when the evidence was thin or stale. Never a “compliant” verdict. Next quarter shows what moved, and anyone can re-check the file at /verify.
RE-CHECK A FROZEN FILE YOURSELFEach control listed with the evidence behind it: failing where an uploaded config shows the problem, passing where you declared it, not assessed where there is nothing yet, with PROVEN kept apart from MODELED. Show-me over trust-me, before the audit starts.
SAMPLE AUDIT-EVIDENCE PACK (PDF)All generated from configs you already have — 1,913 deterministic checks across 37 vendors. No agent, no live scan, nothing fabricated. Decision support for your compliance function — never a filing determination or an accreditation CyberTwin holds.