Keep your operations running, and show the supervisor how

Critical or important functions

Each service records whether it supports a critical or important function, with who reviewed that and when.

A plan looser than the BIA is a finding

If an approved plan promises a slower RTO or RPO than the BIA tolerates, or an asset on the critical path recovers too slowly or has not been verified in 12 months, Pritect raises a remediation action.

Activation needs an approver

Activating a plan from an incident is a request. A named approver accepts or declines it, and both are on the record.

An annual testing programme

What must be tested, how often and whether an independent tester is needed, with last tested, next due and overdue items.

Exercises with results

Tabletop, walkthrough, simulation and full tests, each with findings, actions and planned against actual RTO and RPO.

Exit plans that are tested

Supplier exit plans are approved and tested as exit simulations, and a supplier behind a critical function cannot be offboarded without one.

Major incident classification

Pritect scores the incident against the major incident criteria and proposes a verdict. A named person confirms it, the decision stays on an append-only record, and reversing a major verdict needs a second person. The thresholds are still under expert review.

Recurring incidents

Incidents that share an apparent root cause are grouped, their impact is combined, and the assessment against the major incident criteria is recorded.

Clocks side by side

Each adopted regulation's notification duty becomes an obligation with its own anchor. Where a duty has two limbs, the earlier deadline binds.

Drafts, never sends

A notification draft is grounded on what the obligation requires, abstains when facts are missing, and must be reviewed before use.

A recorded submission

Who submitted, when, by which channel and with which authority reference, then the acknowledgement. Each framework's reporting contacts, including outsourced reporting, are kept in one place. Filing stays with your people.

A post-incident review

One structured review per incident. Each action you choose to track becomes a remediation action, linked to the service, plan, risk or supplier it concerns.

A crisis team ready to call

Declare a crisis from the incident and the team is filled from your standing roster, with deputies, a call order and an after-action report.

An incident dossier

The incident, its timeline and its obligations as a versioned PDF, generated from the record rather than assembled by hand.

Contractual clocks too

Notification commitments in client contracts run as obligations on the same incident as the regulatory ones.

DORA workspace

Scope, register and filing gaps, exit plans, the testing programme, supervisory orders and board resolutions in one read-only view. It shows gaps; it does not grade you.

Resilience strategy

The digital operational resilience strategy as a governed policy, with each required element linked to its evidence.

Obligations and controls

DORA articles as obligations you adopt, own and evidence, mapped to the Pritect Cybersecurity Framework.

Management body

Management body, internal auditor and external reviewer roles with time-limited access, and board resolutions on record.

Third-party risk

Supplier due diligence, ICT concentration risk across functions and locations, and contract clause checks.

Supervisory orders

An order becomes actions with owners and evidence, with a status report on progress.

Chained reporting clocks

The law times the initial notification at 4 hours from classification and at most 24 hours from awareness, the intermediate report at 72 hours after it, and the final report one month after the intermediate one. Pritect will run each clock from the event before it.

Generated reports

Initial, intermediate and final reports in the shape of the reporting template, exported as PDF and JSON and recorded as filed by a person.

Client notices from the classification

A major classification will open the notice to affected clients, to be approved and released to the right stakeholder groups with fallback guidance.