DORA on Azure
DORA on Azure: the four pillars, and the evidence each one needs
DORA is, by design, a continuous regime: ongoing ICT risk management, mandatory resilience testing, and a third-party register that has to stay current. This guide explains what each pillar asks of an Azure environment, and which part of that evidence Cloudivence, formerly Governator, already reads. DORA mapping itself is on the Cloudivence roadmap.
What DORA actually requires from your Azure environment
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) became applicable on 17 January 2025 for financial entities operating in the EU: banks, insurers, investment firms, payment institutions, crypto-asset service providers, and many more. Unlike NIS2, which is broad-spectrum, DORA is sector-specific and explicitly prescriptive. It sets out four pillars that every in-scope entity has to demonstrate, plus a fifth area on information sharing.
On Microsoft Azure, the underlying capabilities exist: Defender for Cloud, Sentinel, Azure Backup, Site Recovery, Lighthouse, the cost and activity logs. What does not exist out of the box is the evidence layer that demonstrates, in regulator-readable form, that the four DORA pillars are operating continuously and that the third-party register is current.
Cloudivence does not map findings to DORA articles yet; that is on its roadmap, with the register of ICT third parties and the incident trail. It already reads part of the Azure evidence the first and the fourth pillars depend on, shown per pillar below.
The four pillars on Azure
Each pillar calls for its own Azure evidence. For each one, the first block is what the pillar calls for, and the second is what Cloudivence reads today.
ICT risk management framework
A documented, board-approved framework that maps controls to identified risks, with periodic review and demonstrable maintenance.
Azure evidence the pillar calls for
Defender for Cloud regulatory dashboard, Azure Policy compliance state, exemption register with reviews, secure score trend.
What Cloudivence reads today
Defender recommendations, Azure Policy compliance and the secure score are read, and control exceptions carry expiry dates. Findings are not mapped to DORA articles yet.
ICT-related incident management & reporting
Classification, reporting, and post-incident analysis of major ICT incidents within the regulator-defined timelines.
Azure evidence the pillar calls for
Sentinel incidents with timeline metadata, Defender alert workflow evidence, runbook attestations, post-incident report register.
What Cloudivence reads today
Not covered. Cloudivence does not read Sentinel incidents or incident timelines.
Digital operational resilience testing
Annual scenario-based testing for in-scope entities, plus Threat-Led Penetration Testing (TLPT) every three years for significant entities.
Azure evidence the pillar calls for
Test plan attestations, scenario-coverage matrix, evidence of corrective actions, dated retest results.
What Cloudivence reads today
Attestations with an evidence link can record a test per control. There is no DORA testing register.
ICT third-party risk management
A maintained register of all ICT third-party arrangements, with criticality assessment, contractual coverage, and exit strategies for critical providers.
Azure evidence the pillar calls for
Service principal inventory mapped to third-party providers, RBAC scope per provider, Lighthouse delegation register, contract metadata.
What Cloudivence reads today
Service principals with privileged roles, and their scope, are listed. There is no register of ICT third parties and no Lighthouse inventory.
Why DORA evidence has to stay current
DORA was written, in regulatory text, as an ongoing regime. The third-party register cannot be twelve months stale. Resilience testing recurs by mandate. Incident reporting is triggered by events, whatever the audit calendar says. A model where you commission a readiness assessment every twelve months, get a fresh PDF, and resume drift in between is structurally a poor fit for the regulation.
Tooling that keeps evidence between two cycles fits that shape better than a yearly snapshot, and that is the direction Cloudivence takes. Today it covers the parts listed per pillar above. The third-party register, the resilience testing register and the incident timelines are not part of the product yet, and GenioCT handles them as consulting work.
What Microsoft gives you, and what Microsoft does not
Microsoft gives you
- ✓Defender for Cloud and Secure Score for ICT risk identification
- ✓Sentinel for incident detection and timeline data
- ✓Azure Backup, Site Recovery, and zone/region redundancy primitives
- ✓Activity Log and audit trail for resource-level changes
- ✓Lighthouse delegation telemetry for cross-tenant access
What DORA still needs on top
- ✓Per-finding mapping to DORA articles (5–14, 17–23, 24–27, 28–44)
- ✓A maintained ICT third-party register tied to actual Azure access
- ✓Resilience-testing register with dated attestations and corrective actions
- ✓Incident classification metadata aligned to DORA reporting timelines
- ✓Pre-audit export with executive summary and article-level evidence matrix
- ✓Continuous-assurance dashboard that demonstrates ongoing operation over time
Defender's regulatory dashboard now includes a DORA initiative, which is a useful starting point for the Articles 5–14 controls. It does not maintain the third-party register, the resilience-testing trail, or the incident-classification metadata that DORA expects. Those layers are consulting work at GenioCT today. DORA mapping in Cloudivence is on the roadmap.
Where to start
Most financial entities running Azure workloads start with a DORA readiness assessment: GenioCT baselines the four pillars, ICT risk management evidence, incident reporting, the resilience testing trail and the third-party register, with Cloudivence covering the Azure evidence it reads today. The assessment produces a scoped roadmap and an evidence pack at a point in time.
Related
Start with an Azure Health Check
Not sure where to begin? A quick architecture review gives you a clear picture. No obligation.
- ✓ Risk scorecard across identity, network, governance, and security
- ✓ Top 10 issues ranked by impact and effort
- ✓ 30-60-90 day roadmap with quick wins