SAMPLE REPORT
DORA Compliance Assessment Report
Digital Operational Resilience Act (EU) 2022/2554
Acme Financial Services Ltd.
Generated by FaultRay v11.0 | 2026-03-29
Classification: CONFIDENTIAL
Assessment Type: Automated Resilience Simulation (Zero-Risk)
Executive Summary
64/100
Overall DORA Score
99.82%
Availability Ceiling
This report presents the results of an automated DORA compliance assessment conducted using FaultRay's zero-risk resilience simulation engine. The assessment covers all 5 DORA pillars across 52 controls, using 2,847 simulated failure scenarios against the production infrastructure topology.
Key Finding: The operational layer (on-call coverage, incident response) is the binding availability constraint at 99.88%. The stated SLA target of 99.95% is physically unreachable without improving operational processes — no amount of hardware investment will close this gap.
DORA Pillar Assessment
Key Findings
- Database lacks automated failover — single point of failure (CRITICAL)
- No documented recovery procedures for payment gateway
- Cache layer has no replication — data loss risk on failure
Evidence (FaultRay)
- FaultRay cascade simulation: DB failure cascades to 7/15 components
- Availability ceiling: 99.82% (below 99.95% SLA target)
Compliance Gaps
- Art. 6(1): ICT risk management framework incomplete — no availability ceiling analysis
- Art. 9(2): Backup and recovery — DB failover not tested
- Art. 11: Business continuity — cascade paths not documented
Key Findings
- Incident classification taxonomy aligned with DORA severity levels
- Automated alerting via PagerDuty integration
Evidence (FaultRay)
- FaultRay incident cost model: mean estimated loss per incident $42K
- Alert coverage: 14/15 components monitored
Compliance Gaps
- Art. 19(1): Major ICT incident reporting to authorities — process not formalized
Key Findings
- No regular resilience testing program in place
- No threat-led penetration testing (TLPT) performed
- Cascade failure scenarios never tested
Evidence (FaultRay)
- FaultRay simulation: 2,847 scenarios tested, 23 critical findings
- Blast radius: single DB failure affects 47% of infrastructure
Compliance Gaps
- Art. 25(1): ICT testing programme — no annual testing schedule
- Art. 26(1): Advanced testing via TLPT — never conducted
- Art. 25(3): Proportionality — testing scope undefined
Key Findings
- 3 critical third-party dependencies identified
- External SLA chain caps availability at 99.9%
- No exit strategy for cloud provider dependency
Evidence (FaultRay)
- FaultRay 5-layer model: External SLA layer is binding constraint
- Third-party cascade: payment processor failure affects 5 downstream services
Compliance Gaps
- Art. 28(2): Proportionality in third-party risk — no tiering of providers
- Art. 30(3): Exit strategies — not documented for critical providers
- Art. 33: Subcontracting — cloud provider subcontracting chain not mapped
Key Findings
- Threat intelligence feeds integrated (CVE, CISA)
- Internal security awareness program active
Evidence (FaultRay)
- FaultRay security feed: auto-generates scenarios from advisories
Compliance Gaps
- Art. 45(1): Voluntary sharing arrangements — not participating in FS-ISAC or equivalent
Cascade Failure Analysis — Top 5 Scenarios
| Scenario | Cascade Path | Blast Radius | Annual Loss |
|---|
| CRITICAL Primary Database Failure |
Core Banking → Payment Gateway → Trading Engine → Customer Portal → AI Fraud Detection |
7/15 components |
$420,000/yr |
| CRITICAL Payment Processor Outage |
Payment Gateway → Core Banking (degraded) → Customer Portal (errors) |
5/15 components |
$280,000/yr |
| HIGH Cache Layer Failure |
Redis → API responses degrade → Trading Engine latency spike → Circuit breaker trips |
4/15 components |
$180,000/yr |
| HIGH Load Balancer Single-Instance |
LB failure → Total service outage for all downstream |
12/15 components |
$156,000/yr |
| HIGH AI Fraud Detection Grounding Loss |
Vector DB down → Fraud Agent hallucination probability 78% → False approvals |
3/15 components |
$95,000/yr |
5-Layer Availability Ceiling Analysis
FaultRay decomposes system availability into 5 independent constraint layers. The effective availability is bounded by the minimum across all layers.
| Layer | Factors | Availability | Nines |
|---|
| Layer 1: Software | Deploy downtime, human error, config drift | 99.92% | 3.09 nines |
| Layer 2: Hardware | MTBF/MTTR, redundancy, failover | 99.98% | 3.70 nines |
| Layer 3: Theoretical | Packet loss, GC pauses, jitter | 99.97% | 3.52 nines |
| Layer 4: Operational | Incident response, on-call coverage | 99.88% ← BINDING CONSTRAINT | 2.92 nines |
| Layer 5: External SLA | Third-party SLA product | 99.90% | 3.00 nines |
Asystem = min(L1, L2, L3, L4, L5) = 99.88% (Layer 4: Operational)
Target SLA: 99.95% — Gap: 0.07% = ~6.1 hours/year of additional downtime risk.
Remediation Roadmap
| # | Action | Component | Annual Cost | Annual Savings | ROI | Timeline |
|---|
| 1 | Add DB replica + failover | Database | $2,400/yr | $420,000 | 175x | 1 week |
| 2 | Redis replication | Cache | $1,200/yr | $180,000 | 150x | 3 days |
| 3 | LB redundancy | Load Balancer | $600/yr | $156,000 | 260x | 3 days |
| 4 | On-call coverage expansion | Operations | $24,000/yr | $95,000 | 4x | 2 weeks |
| 5 | Exit strategy documentation | Governance | $0 | Risk reduction | ∞ | 2 weeks |
Total Fix Cost: $28,200/year | Total Risk Reduction: $851,000/year | Overall ROI: 30x
Methodology
This assessment was conducted using FaultRay v11.0, a zero-risk chaos engineering platform that simulates infrastructure failures entirely in computer memory without affecting production systems. The methodology includes:
- Graph-Based Cascade Simulation: Infrastructure modeled as a directed dependency graph with typed edges (required/optional/async). Failure propagation simulated using a Labeled Transition System (LTS) with 8 formal transition rules and proven termination in O(|C|+|E|).
- 5-Layer Availability Limit Model: Independent availability ceilings computed for hardware, software, theoretical, operational, and external SLA layers.
- AI Agent Cross-Layer Failure Modeling: Hallucination probability H(a,D,I) computed as a function of infrastructure state for AI-based fraud detection components.
- Financial Impact Estimation: Downtime costs computed from component-level cost-per-hour estimates and simulated MTBF/MTTR.
Validation: FaultRay's cascade engine has been backtested against 18 real-world cloud incidents (2017-2023) with F1=1.000 for cascade path prediction. Paper: DOI: 10.5281/zenodo.19139911. US Patent Pending: Application No. 64/010,200.
Disclaimer
This report is generated by automated simulation and does not constitute legal or regulatory compliance advice. The assessment is based on the infrastructure topology model provided and may not reflect all aspects of the organization's ICT environment. Organizations should consult qualified legal and compliance professionals for definitive DORA compliance determinations. Financial estimates are based on industry averages and should be validated against actual organizational data.