ATALAIADORA
For financial entities: ICT risk management, incident reporting, resilience testing and third-party risk, with evidence.
Where you are
DORA has applied since January 2025. Supervisors now ask for an ICT risk framework that works, tests that are run, and a register of the ICT providers you depend on.
Sounds familiar?
- Resilience testing is one pentest a year
- No register of the software suppliers you depend on
- Incident classification decided in the moment
What you need
Each need, why it matters, and what covers it: the services that set it up, and the tower modules that will keep watching it.
- An ICT risk framework
Policies, risk assessment and owners, kept current.
Services
Atalaia tower · Soon
- Resilience testing
A testing programme, from scans to scenario-based tests.
Services
Atalaia tower · Soon
Services only, for now.
- Third-party risk
Your software supply chain, recorded and assessed.
Services
Atalaia tower · Soon
- Incidents you can classify
Detection and a runbook that matches the reporting rules.
Services
Atalaia tower · Soon
Services only, for now.
What it asks, and where the evidence comes from
A simplified reading. Your compliance team decides how it applies to you.
| DORA asks for | Evidence from the line | Who helps |
|---|---|---|
| ICT risk management framework | Policies with owners, risk register | Policies, Compliance & Risk |
| ICT incident reporting | Detections, classification runbook | Detection Engineering |
| Digital operational resilience testing | Test plan, pentest and retest records | Pentest, Security Scans |
| ICT third-party risk | Supplier and package register | Supply Chain Security, Package firewall |
We help you produce the evidence. We are not your auditor or your lawyer.
Services
Policies, audits, risk assessment
See the station →Station 12 · Release & testPentestScoped, manual, retested
See the station →Station 08 · BuildSecurity ScansSAST · SCA · Secrets · IaC · Container
See the station →Station 07 · BuildSupply Chain SecurityPackages, extensions, registries
See the station →Station 17 · RunDetection EngineeringPentest findings become SOC use cases
See the station →Atalaia tower modules
In development. Early-access teams get them first.
What you end up with
- A framework supervisors can read
- A testing programme with retests
- A register of what you depend on
Talk it through
A 30-minute call. No slides, no price list, and a next step either way.