The report exists, but the decision still needs reconstructing
The scanner report is available, yet preparing a review still takes several exchanges: what treatment was agreed for this service, by whom and on what evidence? The vendor reference is in an email, the maintenance window in a schedule and temporary risk acceptance in meeting minutes. Teams spend time reconstructing a decision already made.
Ongoing security management connects this information in one case file: finding, affected systems, assessment, decision, action and verification. Operations knows what to prepare. ICT risk and compliance owners can retrieve the reasoning and documents required for their reviews.
Start with the framework that actually applies to the entity
DORA covers ICT risk management, incidents, resilience testing and third-party risk, among other areas. For the financial entities concerned, it acts as sector-specific legislation within the relationship established with NIS2. Define tracking around the entity’s applicable regime rather than combining two supposedly identical requirement lists.
Within its scope, Article 10 of Delegated Regulation 2024/1774 requires documented vulnerability and patch management procedures. It connects reliable sources, prioritisation, tracking and treatment verification. An up-to-date register can support those procedures alongside the other components of the institution’s DORA arrangements.
Sources: DORA, Regulation (EU) 2022/2554, Articles 1, 5 and 28, Delegated Regulation (EU) 2024/1774, Article 10: vulnerabilities and patches, Commission guidelines on NIS2 sector-specific legislation, DORA annex, ACPR: DORA resources and banking-sector documents
Fictional case: a fix waiting for a maintenance window
Rivage Bank runs an account-viewing service on three servers. Two use module-échange 4.2; the third uses another branch. Advisory DEMO-BANQUE-01 affects the first branch, for which a fix exists. Installation requires application validation and a maintenance window. The names, versions and advisory in this example are fictional.
Operations prepares tests and rollback. The service owner approves the window; the authorised decision-maker approves the temporary measure and its review. The case file retains installed versions, the source and applicability rationale. The third server’s status remains unresolved: fixing the first two cannot close its instance.
| Evidence item | What it should establish |
|---|---|
| Dated assessment | Covered versions, source, rationale and unknowns |
| Temporary decision | Owner, agreed conditions and reassessment |
| Operations action | Owner, window, tests and rollback |
| Treatment evidence | Version actually deployed and planned verification |
Organise tracking that teams can pick up
Start with a service whose assets, versions and owners are identified. Compare tool results with relevant advisories while keeping contradictions visible. Then separate technical severity from treatment priority: supported functions, exposure and operational constraints may justify different decisions for the same dependency.
Distinguish actions in progress, blockers and accepted exceptions. An overdue deadline calls for an identifiable decision or escalation. Specify who researches sources, decides, implements and supplies evidence. New supplier information should allow the assessment to reopen without losing its history.
Measure the time spent on reviews and tracking
Track review preparation time, case files reconstructed because rationale was missing, and the age of blocked actions. Compare these measures within a stable scope. Reallocated hours are available capacity; an expense is avoided only when a cost genuinely ceases to be incurred.
Entrust CyberLifeCycle with monitoring, assessment and vulnerability tracking for your scope. Starting with your inventories and SBOMs, we prepare priorities, alerts and case files for reviews. The institution retains decisions and responsibility for its arrangements; authorised teams or its provider implement fixes.
Sources: DORA, Regulation (EU) 2022/2554, Articles 1, 5 and 28
Sources consulted
- DORA, Regulation (EU) 2022/2554, Articles 1, 5 and 28Accessed on 30 October 2026.
- Delegated Regulation (EU) 2024/1774, Article 10: vulnerabilities and patchesAccessed on 30 October 2026.
- ACPR: DORA resources and banking-sector documentsAccessed on 30 October 2026.
- Commission guidelines on NIS2 sector-specific legislation, DORA annexAccessed on 30 October 2026.