DORA evidence

Which checks map to DORA

DORA asks financial entities to manage ICT risk across change management, resilience testing, and incident handling. DriftGuard contributes evidence for the change-management and ICT-risk articles by gating every infrastructure PR through the same review pipeline:

• ICT risk (Art. 6–8) — Checkov security misconfig scan + policy gate on each change.
• Change management (Art. 9) — live-state drift detection proves the plan matches reality before merge.
• Learning & evolving (Art. 13) — semantic recall surfaces prior incidents linked to the same resources.

Availability

There is nothing to configure — every PR through the review pipeline produces this evidence automatically, for every repository you've enabled.

Evidence emitted per PR

Every finding is mapped to the compliance controls it exercises (a real citation — DORA article, NIS2 measure, or ISO 27001 Annex A clause — from a fixed catalog, not generated text) and cited in the PR's AI review under "Compliance notes". The analysis outcome is also written to the append-only audit log so it can be looked up later.

{
  "control_id": "encryption_at_rest",
  "triggering_rule": "CKV_AWS_16",
  "refs": [
    { "framework": "DORA", "code": "Art.9", "title": "ICT risk protection and prevention" },
    { "framework": "NIS2", "code": "Art.21(2)(h)", "title": "Cryptography and encryption policies" },
    { "framework": "ISO27001", "code": "A.8.24", "title": "Use of cryptography" }
  ]
}

DriftGuard is early access — control identifiers come from a fixed catalog (compliance/controls.py) that should be reviewed with your own compliance team. It is a source of evidence, not a certification.