Language:
PRODUCTS▾
Home Core Serverless Edition Why It’s Different CDS — Constitutional Screening STFL — Sovereign Transaction Finance Layer Defence 🏰 Verify Security All Gates
MORE▾
ASSURANCE
Execution Rights Capabilities Authoritative Sources Evidence Evidence Registry Fortress Baseline Adversarial Verification Machine Law Evolution
SOLUTIONS
Institutions Jurisdictions Due Diligence
RESOURCES
Facts Press Newsroom FAQ Machine Law — The Book Gate SDK Gamechangers The Sound of Machine Law
COMMERCIAL
Pricing Investors
Quantum Security 🔍 Search Request Access →
gateDORA — Digital Operational Resilience Gate
// IMMO.QUICK · GATEDORA · VO (EU) 2022/2554

No onboarding, without verified resilience.

gateDORA forensically seals that an ICT third-party onboarding passes six clusters, ICT risk management, incident reporting, TLPT, third-party register, subcontracting consent, and concentration risk, before the provider is connected. Support for financial entities, never a replacement for a regulator's own recognition as evidence.

Request Access → See the architecture
In one sentence: gateDORA checks every ICT third-party onboarding against DORA requirements before the connection is technically established.
✓ RELEVANT IF...
  • You are a financial entity connecting ICT third-party providers under DORA
  • You need to prove concentration risk for critical ICT service providers
✕ NOT RELEVANT IF...
  • You expect a regulator to automatically recognise the result as approval
  • No financial entity or ICT third-party provider is involved
// The problem

A third-party outage today hits the entire chain.

DORA requires seamless control over ICT third-party providers, from the register duty to concentration risk review. gateDORA checks all six clusters before every onboarding, not only at the next audit.

Board responsibility becomes a sealed fact
DORA explicitly anchors ultimate responsibility for ICT risk with the management body. The gate seals the approval decision with a timestamp and risk acceptance.
// Architecture

6 clusters, checked sequentially.

Every cluster is dispositive (material_block_mode: true), a hit blocks bindingly, not merely for documentation.

CLUSTER 1
ICT Risk Management
Checks whether a documented ICT risk management framework with asset and threat analysis exists.
ict_framework_documented · risk_scoring_current
CLUSTER 2
Incident Reporting
Checks the classification of a major ICT incident and timely reporting to the competent authority.
incident_classified_major · reported_within_deadline
CLUSTER 3
Threat-Led Penetration Testing (TLPT)
Checks, for critical functions, whether TLPT has been performed within the mandated three-year cycle.
tlpt_required · tlpt_completed_within_cycle
CLUSTER 4
Third-Party Register
Checks whether the provider is fully recorded in the register of information on ICT third-party providers.
register_entry_complete
CLUSTER 5
Subcontracting Consent
Checks whether the provider's subcontracting relationships have been disclosed and approved by the financial entity.
subcontracting_disclosed · consent_obtained
CLUSTER 6
Concentration Risk
Checks dependency on a single critical ICT provider against the internal concentration-risk threshold.
concentration_risk_score · threshold_exceeded
No case, no doubt
Every cluster returns its own sealed result. A single hit in an active cluster is enough to block the overall action.
// Test results

Two tested scenarios.

All values on this page are fictional test data and serve only to illustrate the gate logic.

Scenario C1C2C3C4C5C6 Verdict Latency
Cloud provider, TLPT current, register complete, concentration risk lowPASSPASSPASSPASSPASSPASSDORA_SEALED478ms
Critical ICT provider without register entryPASSPASSPASSFAILnot evaluatednot evaluatedBLOCK_DR4_REGISTER_ENTRY_MISSING401ms
Cryptographic chain continuation
Every test produces a deterministic receipt_id, an input_snapshot_hash, an HMAC-SHA256 signature, and a merkle_link to the previous receipt. Persistence occurs in the gateDORAReceipt entity with a 10-year retention period.
// Clarification

What gateDORA is not.

  • Not automatic recognition by a European supervisory authority. The gate delivers a cryptographic proof, not regulatory approval.
  • Not an independent ICT security system. The gate seals the onboarding check, it does not replace ongoing technical monitoring.

For financial entities that want to make ICT third-party onboarding provable.

Request Access → access@immoquick.eu
Request Access →