Regulated finance · ECZ-ID IoT
DORA ICT-vendor evidence
Prepare reusable ICT-vendor evidence for customers operating under DORA.
The DORA solution helps an ICT provider organise identity, service, resilience and supporting evidence into a reusable review pack for financial-sector customers and their procurement or risk workflows.
- Type
- Solution
- Price
- Not restated on this site; TrustOps publishes the current price and availability
- Acquired and paid in
- TrustOps
- Operated in · proved by
- Dashboard · Resolver
The problem
Why it matters.
Financial-sector customers must evidence their ICT third parties. Suppliers answer the same resilience and vendor-risk questions again and again, from scattered documents.
Built for
- Technology suppliers selling ICT services into EU-regulated financial entities.
- Teams repeatedly answering the same vendor-risk and operational-resilience questions.
- Providers that want a structured evidence pack rather than a loose collection of attachments.
What changes
- Faster preparation for customer ICT-vendor reviews.
- More consistent evidence across repeated questionnaires and procurement cycles.
- A clearer link between the supplier identity, service surface and supporting evidence.
What you receive
Concrete deliverables, not a vague trust score.
- Structured DORA-oriented vendor evidence organisation.
- Reusable identity and service context from the ECZ-ID estate.
- Evidence packaging suitable for customer review workflows.
- Paths for managed and enterprise depth where the requirement is larger.
- Supplier
- Your organisation and its Parent tier
- Service
- The ICT service in scope, with its ECZ-ID
- Evidence
- Eligible identity, service and supporting evidence, organised
- Gaps
- Material gaps identified, not filled by assumption
- Boundary
- Supports evidence preparation — does not certify DORA compliance
Illustrative structure.
How it works
A short path from need to something usable.
Define the ICT service and the customer review context.
Map the evidence you already hold and identify material gaps.
Organise eligible evidence into a reusable review structure.
Maintain the evidence set as the service and supplier relationship change.
How it relates to your Passport
DORA evidence uses the same identity foundation as every Passport: the supplier's Parent, the ECZ-ID of the connected device and the evidence around it. It matters wherever your customers are regulated financial entities reviewing their ICT suppliers.
Use cases
- An IoT platform or connected-product provider whose customers include banks or insurers that apply DORA to their ICT suppliers.
- Re-using one evidence structure across repeated vendor reviews.
Tiers and price
Price and availability
Prices and what can be bought today come from TrustOps, which owns every purchase, entitlement and renewal. This site does not restate this product's price; TrustOps publishes its current tiers, price and availability, and shows them before anything is bought.
How it is arranged
TrustOps acquires
TrustOps publishes the tiers and holds payment and entitlement whenever it is offered.
Dashboard operates
Once you hold it, it appears in your Dashboard, where you operate it.
Resolver proves
Public facts stay on the Resolver; holding it never changes what a record proves.
Privacy, security and evidence
What is collected, published and kept.
- The regulated entity and its advisers remain responsible for their own legal and risk conclusions.
- Evidence publication requires your consent.
- ECZ-ID does not certify DORA compliance.
Boundaries
The claims stop here.
- ECZ-ID supports evidence preparation and review; it does not certify DORA compliance.
- The regulated entity and its advisers remain responsible for their own legal and risk conclusions.
Integrations and questions
Works with what you already run.
- Parent VERIFIED or ASSURED: each DORA tier requires one, and its price includes it.
- LedgerCore for append-only evidence records.
- Your existing vendor-risk questionnaires and procurement portals.
- Does this make my connected device DORA compliant?
- No. ECZ-ID supports evidence preparation and review. It does not certify compliance.
- Does this apply to every IoT provider?
- It applies when your customers are EU-regulated financial entities reviewing their ICT suppliers.
Related
- CounterpartyDCI — Digital Counterparty InfrastructureMake a digital counterparty easier for people and machines to identify, inspect and re-check.Read more
- Software supply chainSBOM & software-composition evidenceTurn software composition and provenance into evidence a buyer can actually review.Read more
- Evidence · HistoryLedgerCoreKeep decisive identity and lifecycle evidence without pretending evidence proves the claim inside it.Read more
Keep the identity free. Everything above it is optional.
Your IoT Passport stays free. DORA ICT-vendor evidence sits above it; TrustOps shows its current state.