DORA-Ready in Practice: What Auditors Actually Ask of Your Virtualization Stack
DORA has applied since 17 January 2025, and most of what is written about it is written by lawyers for lawyers. The half that lands on the infrastructure team is four artefacts: the ICT register, the exit plan, exit-test evidence, and the sub-outsourcer map. What each one means technically, what the regulation actually says, and the architectural pattern that makes them defensible.
