DORA entered into force in January 2025. Financial services firms subject to DORA — banks, investment firms, insurance companies, payment institutions and their critical ICT third-party providers — are now under active supervisory oversight for digital operational resilience.
Having worked with financial services cloud teams through DORA preparation and now into the enforcement period, five ICT risk management gaps appear most consistently.
The five gaps
Incomplete ICT asset inventory — DORA Article 8
DORA Article 8 requires a complete, current register of ICT assets supporting critical or important functions. For most organisations, the cloud estate is not fully mapped. Resources deployed through ClickOps, inherited from acquisitions or deployed by development teams outside the governance process are invisible to the ICT risk management function. ZAP solves this structurally — every resource deployed through ZAP is catalogued in the CMDB immediately. Brownfield governance extends this to existing resources.
Missing ICT incident documentation — DORA Article 17
DORA Article 17 requires financial entities to manage ICT incidents through a defined process with documented timeline, impact and resolution. Many financial services IT teams use email and chat for incident response rather than a formal ITSM workflow. When a regulator asks for the incident register, the evidence is not in a reviewable format. ZAP auto-raises ITSM incidents on every HIGH finding — with resource ID, CIS control, RCA analysis and resolution documentation — and auto-closes them on verified remediation.
Undocumented ICT third-party dependencies — DORA Article 28
DORA Article 28 requires comprehensive ICT third-party risk management. Shadow AI — unapproved AI workloads running in production Kubernetes clusters — creates undocumented ICT third-party dependencies that are invisible to the risk management function. ZAP detects every AI container across all clusters and requires documented approval for whitelist status. This creates the third-party AI inventory that DORA Article 28 requires.
Untested operational resilience — DORA Article 25
DORA Article 25 requires digital operational resilience testing, including testing of ICT recovery capabilities. Most financial services organisations have DR documentation that has not been tested recently. ZAP Migrate enables Azure-to-Azure replication into compliant landing zones with post-replication compliance verification — generating the DORA ICT continuity evidence automatically.
Missing continuous monitoring
DORA requires that financial entities maintain continuous ICT risk awareness — not just point-in-time assessments. An annual penetration test or quarterly compliance scan does not satisfy continuous monitoring requirements. ZAP scans continuously on a configurable cycle (default every six hours) and detects drift within minutes of its occurrence. The compliance dashboard reflects the current state of the estate at all times.
None of these require a multi-year programme
None of these gaps requires a multi-year programme to fix. Each has a ZAP capability that addresses it directly. The organisations that are best positioned for DORA examination are those that have continuous monitoring, automated incident documentation and complete asset inventory in place. These are the same capabilities that make a well-governed cloud estate operationally resilient.
See ZAP live
Book a 30-minute session with the Zentej team. We show you ZAP live on our instance — landing zone, compliance scan, evidence generation, ZAP AI. No commitment.