Topic starter
10/07/2026 9:18 pm
TL;DR: Many European financial firms were still not compliant in early 2026, and Gartner expects 40% will miss DORA requirements when audits and follow-up inspections begin later this year, according to JupiterOne. Static spreadsheets, CMDBs, and traditional GRC tools cannot maintain the live dependency and control evidence DORA expects.
Editorial analysis by NHI Mgmt Group, based on content published by JupiterOne: “DORA Is a Graph Problem. Most Firms Are Trying to Solve It With a List”.
By the numbers:
- Nearly half of European financial firms were not compliant in early 2026, according to JupiterOne.
Key questions
Q: What breaks when DORA compliance is managed with spreadsheets and CMDBs?
A: Static tools break the evidence chain.
Q: Why does DORA make continuous visibility more important than periodic audit checks?
A: DORA expects institutions to demonstrate current operational resilience, which means the control evidence has to reflect the live environment rather than a monthly or quarterly snapshot.
Q: How do security teams know if DORA control evidence is actually working?
A: Control evidence is working when it can be regenerated from live telemetry, not manually reconstructed for an audit.
Practitioner guidance
- Build a live Register of Information Model assets, controls, identities, code, and providers as continuously updated relationships rather than static entries in a spreadsheet or CMDB.
- Map identity and service dependencies together Include user identities, machine identities, cloud services, and SaaS applications in the same dependency structure so regulatory evidence reflects real operational paths.
- Replace snapshot attestations with continuous evidence Pull control evidence from operational systems on an ongoing basis so DORA reports can be supported by current telemetry instead of periodic review notes.
Bottom line: DORA exposes the weakness of compliance programmes built on static inventories, because the regulation expects live evidence of assets, dependencies, and controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:41 pm
Live relationship evidence is now the compliance boundary, not static inventory. DORA turns asset context into a control requirement because institutions must prove current dependencies, not merely maintain a catalog. That shifts the governance question from whether an asset is listed to whether its relationships are continuously observable. Practitioners should treat live graph data as part of the compliance control plane, not as a reporting convenience.
A question worth separating out:
A: Accountability should sit with executive leadership and be shared through a formal governance model. DORA expects board-level oversight, clear ownership from the CISO and compliance function, and coordination across IT, risk, legal, and procurement. If responsibility is fragmented, controls drift, vendor oversight weakens, and incident response becomes slower and harder to evidence during review.
👉 Read our full editorial: DORA compliance is a graph problem, not a list problem