Docs

Appearance

Operationalizing in Modulos ​

DORA execution works best when organization governance (OFF-16) and AI-system execution (MFF-16) are coordinated as one delivery program.

Most teams use:

  • one organization project for OFF-16 governance obligations
  • one or more AI-system projects for MFF-16 execution obligations

Where in Modulos ​

  • Project → Settings → Frameworks: add OFF-16 and MFF-16 to relevant projects
  • Project → Requirements: assign owners and track readiness per requirement
  • Project → Controls: execute controls and preserve review decisions
  • Project → Evidence: store incident, testing, third-party, and governance artifacts

A sequence that works ​

  1. Determine scope and proportionality (ORF-303) and define accountability (ORF-304).
  2. Establish ICT risk framework and control governance (ORF-305, ORF-306, MRF-275).
  3. Implement ICT risk operations across prevention/detection/response (ORF-307 to ORF-317; MRF-276 to MRF-286).
  4. Run resilience testing and TLPT workflows (ORF-318; MRF-287, MRF-288).
  5. Operationalize ICT third-party risk and register workflows (ORF-319; MRF-289 to MRF-291).
  6. Maintain threat-sharing and secondary-legislation update cycles (ORF-320, ORF-321; MRF-292, MRF-293).

Evidence package baseline ​

A defensible DORA package usually includes:

  • applicability and proportionality decision records
  • management body governance and training evidence
  • ICT inventory, risk assessment, and control operation evidence
  • major-incident staging and reporting evidence
  • resilience testing and TLPT outcomes with remediation tracking
  • ICT third-party due diligence, contract, and register evidence
  • delegated/implementing act impact assessments and control updates
DORA overview

Framework structure and OFF-16/MFF-16 split

Testing and third-party risk

Resilience testing and ICT third-party execution model

Information sharing and secondary legislation

Ongoing obligations that require update governance

Disclaimer

This page is for general informational purposes and does not constitute legal advice.