Question 1

What is ICT risk management under DORA?

Accepted Answer

ICT risk management under DORA (the EU Digital Operational Resilience Act) requires regulated financial entities to maintain a comprehensive, continuously updated register of all ICT assets — including internal systems, third-party services, AI agents, and data assets — with named ownership and documented governance. DORA Chapter II sets out the specific requirements for ICT risk frameworks.

Question 2

What software helps with DORA ICT risk management?

Accepted Answer

Ethira provides a live internal asset register that auto-populates from your HRIS, ITSM, SSO, and infrastructure tooling. It covers every system, API, AI agent, MCP server, and dataset inside your boundary, tracks named ownership over time, and generates continuous evidence packs mapped to DORA ICT risk management, ISO 22301, and ISO 42001.

Question 3

How do I maintain a live internal asset register for DORA?

Accepted Answer

Ethira ingests data from your existing tooling — HRIS, ITSM, SSO providers, cloud infrastructure APIs — to build and maintain an asset register automatically. New assets are discovered and catalogued without manual tagging. Ownership is tracked as a property of each asset, so orphaned assets are surfaced immediately when owners change.

Question 4

How do I catalogue AI agents and MCP servers for DORA and the EU AI Act?

Accepted Answer

Ethira treats AI agents, MCP servers, and the models powering them as first-class inventory entities — the same as any other ICT asset. Each is catalogued with its owner, access scope, model version, and governance status. This gives you the AI system documentation required by the EU AI Act and the ICT asset coverage required by DORA.

Question 5

Is Ethira compliant with ISO 22301 and ISO 42001?

Accepted Answer

Ethira generates continuous evidence packs mapped to DORA ICT risk management, ISO 22301 (business continuity), and ISO 42001 (AI management systems). The evidence is updated automatically and is exportable on demand, so your auditors can verify coverage at any time without requiring a manual rebuild.

Your internal estate, Governed like your vendors.

There's no live register of your internal systems

Ownership goes stale within months

Every audit cycle is a rebuild

The capabilities

Govern your internal estate the same way you govern your vendors.