T310 · Cat-22 · DORA & Operational Resilience · AP2 Agentic Anchor

AP2 DORA Policy Mandate Builder

Configure ICT risk appetite thresholds, incident escalation triggers, third-party review cadence, TLPT scheduling, Register of Information update frequency, and NCA submission calendar across all 5 DORA pillars. Outputs a validated Policy Mandate JSON DORA policy mandate, board-level policy summary, and machine-readable agent instruction set.

v1.0

⚡ AP2 Agentic — Generates machine-readable mandate + agent instruction set

Scope & reliance — 🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only. Embedded rates, thresholds, and regulatory citations are static reference values that may age — verify against current primary sources and your own data before relying on any output for commercial, legal, or compliance decisions. Deterministic logic · no inference · zero PII · CC BY 4.0.

Educational Use Only This tool provides a self-assessment / educational framework for internal planning purposes only. It is not a regulatory audit, legal advice, or a substitute for a formal compliance review by a qualified advisor. Verify all interpretations against the official source text and applicable RTS/ITS/guidance published by the relevant authority.

ICT Risk Management — Risk Appetite

Art. 5–16 DORA · RTS 2024/1772

ICT Risk Appetite Level

ICT Risk Framework Review Cadence

RTO — Critical CIF Functions (hours)T1 RTO must be ≤72h (Art. 11)

RPO — Critical CIF Functions (hours)

BCP Test Frequency

AI Systems in ICT Functions?

Incident Management — Escalation Triggers

Art. 17–23 DORA · RTS 2024/1772 · ITS 2025/302

Major Trigger — Clients (count)RTS threshold: 10,000

Major Trigger — Economic Impact (€)RTS threshold: €5,000,000

Major Trigger — Duration (hours)

Internal Notification SLA (minutes)Must allow NCA filing within 4h

Incident Runbook Status

Primary NCA

III

Resilience Testing — Schedule

Art. 24–27 DORA · TIBER-EU

Vulnerability Scan Frequency

Penetration Test Frequency

TLPT Required?

Next TLPT Date (if required)

Third-Party Risk — Review Cadence & RoI

Art. 28–44 DORA · ESA xBRL-CSV RoI

ICT Third-Party Provider Review Cadence

RoI Submission Format

CTPP Oversight Monitoring

Exit Plan Tested?

Information Sharing & NCA Submission Calendar

Art. 45–49 DORA · Multi-jurisdiction

Information Sharing Arrangement (Art. 45)

Primary Threat Intel Source

EU Jurisdictions Covered

RoI Submission Buffer (days before NCA deadline)

Internal DORA Audit Cycle

Board DORA Reporting Frequency