DORA Resilience
Evidence Report

Overall compliance status:  {{ exec.overall_status.upper().replace('_', ' ') }}    Compliance Rate: {{ exec.compliance_rate_percent }}%

{% set total = exec.total_controls %} {% set compliant_pct = (exec.compliant / total * 100) | round(1) if total > 0 else 0 %} {% set partial_pct = (exec.partially_compliant / total * 100) | round(1) if total > 0 else 0 %} {% set nc_pct = (exec.non_compliant / total * 100) | round(1) if total > 0 else 0 %} {% if exec.article_statuses %}

Article-Level Results

{% set article_labels = { "article_5": "Art. 5 — ICT Risk Mgmt Framework", "article_6": "Art. 6 — ICT Risk Mgmt Governance", "article_7": "Art. 7 — ICT Systems & Tools", "article_8": "Art. 8 — Identification", "article_9": "Art. 9 — Protection & Prevention", "article_10": "Art. 10 — Detection", "article_11": "Art. 11 — Response & Recovery", "article_12": "Art. 12 — Backup & Recovery", "article_13": "Art. 13 — Learning & Evolving", "article_14": "Art. 14 — Communication", "article_15": "Art. 15 — Simplified ICT Risk Mgmt", "article_16": "Art. 16 — RTS Harmonisation", "article_17": "Art. 17 — Incident Mgmt Process", "article_18": "Art. 18 — Incident Classification", "article_19": "Art. 19 — Incident Reporting", "article_20": "Art. 20 — Reporting Templates", "article_21": "Art. 21 — Centralised Reporting", "article_22": "Art. 22 — Supervisory Feedback", "article_23": "Art. 23 — Payment Incidents", "article_24": "Art. 24 — Testing Programme", "article_25": "Art. 25 — TLPT", "article_26": "Art. 26 — Tester Requirements", "article_27": "Art. 27 — Mutual Recognition", "article_28": "Art. 28 — Third-Party Risk", "article_29": "Art. 29 — Concentration Risk", "article_30": "Art. 30 — Contractual Provisions", "article_45": "Art. 45 — Info Sharing" } %} {% for art_key, art_data in exec.article_statuses.items() %} {% endfor %}

Article	Status
{{ article_labels.get(art_key, art_key) }}	{{ art_data.status.upper().replace('_', ' ') }}

{% endif %}

{% if pdf_data.gap_analysis_table %} {% for gap in pdf_data.gap_analysis_table %} {% endfor %}

Control	Status	Risk Score	Key Gap	Recommendation
{{ gap.control_id | e }}	{{ gap.status.upper().replace('_', ' ') }}	{{ "%.2f" | format(gap.risk_score) }}	{{ (gap.gaps[0] if gap.gaps else "—") | e | truncate(100) }}	{{ (gap.recommendations[0] if gap.recommendations else "—") | e | truncate(100) }}

{% else %}

No gap analysis data available.

{% endif %}

{% for item in pdf_data.evidence_table %} {% endfor %}

Control	Timestamp	Test Type	Result	Severity	Remediation	Sign-off
{{ item.control_id | e }}	{{ item.test_timestamp[:19] | e }}	{{ item.test_type | e }}	{{ item.result | e }}	{{ item.severity.upper() }}	{{ "Yes" if item.remediation_required else "No" }}	{{ item.sign_off_status | e }}

{% for item in pdf_data.remediation_plan | sort(attribute='severity', reverse=False) %} {% endfor %}

ID	Control	Severity	Action	Effort	Deadline
{{ item.item_id | e }}	{{ item.control_id | e }}	{{ item.severity.upper() }}	{{ item.title | e | truncate(80) }}	{{ item.effort | e }}	{{ item.remediation_deadline | e }}

{% for entry in pdf_data.register_of_information %} {% endfor %}

Provider	Type	Criticality	Dependents	Concentration Risk	Exit Strategy
{{ entry.provider_name | e }}	{{ entry.provider_type | e }}	{{ entry.criticality.upper() | e }}	{{ entry.dependent_functions | length }}	{{ "Yes" if entry.concentration_risk else "No" }}	{{ "Yes" if entry.exit_strategy_documented else "No" }}

Report ID: {{ meta.report_id | e }}
Generated: {{ meta.generated_at[:19] | e }} UTC
Signed: {{ "Yes" if signed else "No" }}
Total Evidence Items: {{ pdf_data.evidence_table | length }}

{% if audit_chain %}

Evidence Chain (SHA-256)

{% for entry in audit_chain %} {% endfor %}

Seq.	Control	Test Type	Timestamp	Integrity Hash
{{ entry.sequence }}	{{ entry.control_id | e }}	{{ entry.test_type | e }}	{{ entry.test_timestamp[:19] | e }}	{{ entry.integrity_hash | e if entry.integrity_hash is defined else "—" }}

{% endif %}

A. Glossary

Term	Definition
DORA	Digital Operational Resilience Act (EU 2022/2554), applicable from 17 January 2025.
ICT	Information and Communication Technology.
TLPT	Threat-Led Penetration Testing — live production tests by qualified external testers (Art. 25-27).
RTO	Recovery Time Objective — target time to restore operations after an incident.
RPO	Recovery Point Objective — acceptable data loss window measured in time.
SPOF	Single Point of Failure — component whose failure causes system-wide disruption.
HHI	Herfindahl-Hirschman Index — concentration metric for third-party provider risk (Art. 29).
ITS	Implementing Technical Standards — technical specifications issued by ESAs under DORA.
RTS	Regulatory Technical Standards — binding standards issued by ESAs under DORA.
NCA	National Competent Authority — supervisory body receiving DORA incident reports.

B. Methodology

This report is generated by FaultRay version {{ meta.faultray_version | e }}, a chaos-engineering-based DORA evidence platform. Compliance assessment uses static graph analysis of the infrastructure model to evaluate 52 DORA controls across Articles 5–30 and 45. Evidence records are produced from chaos scenario execution results mapped to DORA control requirements. Gap scores are calculated as weighted sums of control-level risk indicators. Remediation deadlines are assigned according to severity classification per DORA Article 19.

This assessment covers Article 24 scenario-based testing only. Article 25 TLPT must be performed by qualified external testers on live production systems. This report does not constitute legal advice and should be reviewed by qualified compliance counsel before regulatory submission.