DORA Support for Financial Entities

External monitoring and vendor documentation to support your DORA programme.

Last updated: 21 August 2026

StatusCake can support your DORA programme in two ways.

Use external monitoring to independently check the availability and performance of important ICT services, and use our contractual and compliance documentation when your organisation needs to assess StatusCake as an ICT third-party provider.

StatusCake supports parts of a DORA compliance programme. Using StatusCake does not by itself make your organisation DORA compliant.

What is DORA?

The Digital Operational Resilience Act (DORA — Regulation (EU) 2022/2554) is an EU regulation for the digital operational resilience of financial entities. It places requirements around ICT risk management, incident management, resilience testing and the management of ICT third-party risk.

StatusCake is not a complete DORA solution. Our role is narrower: helping your team monitor important services from outside your own infrastructure, and providing documentation that can support your assessment of StatusCake as a technology supplier.

Read the regulation on EUR-Lex

How StatusCake can support your DORA programme

Monitor important ICT services from outside your infrastructure

External monitoring gives your team an independent view of whether the services you rely on are available and behaving as expected. It complements internal monitoring and observability by checking from outside the systems being monitored.

• Uptime and API monitoring — Run checks against websites and API endpoints and alert your team when expected conditions are not met.
• Multi-location monitoring — Check services from multiple global locations to help identify regional or network-specific failures.
• SSL and domain monitoring — Track certificate and domain status so expiration or configuration issues can be identified before they become customer-facing problems.
• Server monitoring — Monitor server availability and performance signals that help your team identify infrastructure issues.
• Page speed monitoring — Track how important pages perform over time and identify changes that need investigation.
• Alerting and reporting — Route alerts through notification groups and retain monitoring history and reports that can support internal reviews and evidence of monitoring activity.

Support ongoing operational risk management

Monitoring helps your team identify failures, degradation and recurring performance problems earlier. Historical data can also support ongoing review of service behaviour rather than relying only on point-in-time assessments.

Using StatusCake as an ICT third-party provider

If your organisation needs to assess StatusCake as part of its ICT third-party risk process, we can provide a standard set of legal, data-protection and corporate documentation to support that review.

• Standard DORA contract amendment — Our standard contractual amendment covering the DORA-related terms we support as part of a standard engagement.
• Data Processing Agreement and data-protection information — Documentation explaining the relevant processing relationship and our data-protection commitments.
• Subprocessor and data-location information — Information about relevant third parties and where data is processed or hosted.
• Transfer Impact Assessment — Supporting documentation for applicable cross-border data-transfer assessments.
• Information-security documentation — Policies and supporting information that describe the security controls and processes relevant to the StatusCake service.
• Corporate compliance information — Company, governance, beneficial ownership and sanctions information typically requested during supplier due diligence.
• Legal Entity Identifier (LEI) — 213800BZPGJADPTFLB52, to support your own register-of-information reporting.
• NDA — A standard non-disclosure agreement where one is required for the review process.

We can also provide supporting company and service information to help your team complete its internal vendor records and DORA documentation.

Additional audit, testing and contractual requirements

Some financial entities have requirements that go beyond our standard contractual and compliance package. If your assessment requires bespoke DORA clauses, audit participation, penetration testing or other assurance work, we will review the requirement with you.

Requirements beyond our standard arrangement may need to be separately scoped and priced because they change the commercial, operational or risk profile of the engagement.

How a DORA engagement works

• Start with monitoring — if you're ready to begin, create the monitors your team needs for websites, APIs, certificates, domains, servers or page performance.
• Start with documentation — if your process requires vendor review before onboarding, tell us what your compliance, legal or procurement team needs and we'll provide the standard documentation available for your assessment.
• Review anything outside the standard package — if you need bespoke terms, testing or audit participation, we'll review the scope and confirm any additional commercial requirements before work starts.

These can happen in either order, or in parallel, depending on your organisation's own procurement process.

DORA FAQs

Is StatusCake DORA compliant?

DORA does not operate as a simple product certification. StatusCake can support financial entities with external monitoring, vendor documentation and contractual terms relevant to DORA, but each financial entity remains responsible for its own DORA compliance.

Can StatusCake make my organisation DORA compliant?

No. Monitoring is one part of a wider operational-resilience and third-party risk programme. StatusCake can provide monitoring evidence and supplier documentation, but it does not replace your organisation's broader DORA controls, governance or compliance processes.

Can StatusCake sign a DORA amendment?

We provide a standard DORA contract amendment for engagements where it is required. If you need changes beyond our standard terms, we will review them separately.

Does StatusCake support audit or penetration-testing requirements?

Additional audit participation, penetration testing or other assurance activity can be reviewed where required. These requests are outside the standard package and may need to be separately scoped and priced.

Can StatusCake help monitor third-party ICT services?

Yes, where the service exposes a website, API, certificate, domain, server or other supported target that StatusCake can check externally. This can provide an independent view of availability and performance alongside the provider's own monitoring.

What is DORA's regulation number?

DORA is Regulation (EU) 2022/2554 of the European Parliament and of the Council.

Is StatusCake a critical or important ICT function under DORA?

Based on our discussions with customers to date, StatusCake is not typically classified as supporting a critical or important function. This determination is ultimately for each financial entity to make as part of its own ICT risk management framework.

Get started

Start monitoring the services that matter to your organisation, or contact our team if you need DORA-related vendor documentation before you proceed.