DORA evidence from your Kubernetes cluster

What the framework asks

15 clauses a cluster can answer.

Citations and titles as the report prints them. Open a clause to read what it asks, restated close to the instrument's own words.

Digital Operational Resilience Act

Regulation (EU) 2022/2554

Chapter II Articles 8 to 11 (ICT risk management: identification, protection and prevention, detection, response) and Chapter V Article 28 (ICT third-party risk)

Citation	Clause	Report sections
Article 8(1)	Identify, classify and document ICT assets Financial entities shall identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the information assets and ICT assets supporting those functions, and review the adequacy of that classification yearly.	CoverageControl statement
Article 8(6)	Maintain and update inventories Financial entities shall maintain relevant inventories and update them periodically and every time any major change occurs.	Coverage
Article 8(5)	Identify processes dependent on third-party providers Financial entities shall identify and document all processes that are dependent on ICT third-party service providers.	Control statementSupply chain
Article 9(2)	Availability, authenticity, integrity and confidentiality of data Financial entities shall design, procure and implement ICT security policies, procedures, protocols and tools that aim to ensure the resilience, continuity and availability of ICT systems, and to maintain high standards of availability, authenticity, integrity and confidentiality of data, whether at rest, in use or in transit.	Supply chainControl statement
Article 9(3)(b)	Minimise the risk of technical flaws Financial entities shall minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity.	CoverageAdmission decisionsOutcomes
Article 9(4)(c)	Limit logical access to what legitimate functions require Financial entities shall implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only.	Control statementAdmission decisions
Article 9(4)(d)	Strong authentication mechanisms Financial entities shall implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems.	Evidence chain
Article 9(4)(e)	ICT change management Financial entities shall have documented policies, procedures and controls for ICT change management, ensuring that all changes are recorded, tested, assessed, approved, implemented and verified in a controlled manner.	Control statementAdmission decisionsEvidence chain
Article 9(4)(f)	Patches and updates Financial entities shall have appropriate and comprehensive documented policies for patches and updates.	Control statementCoverageAdmission decisionsOutcomesIssues
Article 10(1)	Promptly detect anomalous activities and single points of failure Financial entities shall have in place mechanisms to promptly detect anomalous activities, including ICT network performance issues and ICT-related incidents, and to identify potential material single points of failure. All detection mechanisms shall be regularly tested.	CoverageAvailability
Article 10(2)	Alert thresholds and criteria to trigger response The detection mechanisms shall enable multiple layers of control, define alert thresholds and criteria to trigger and initiate ICT-related incident response processes, including automatic alert mechanisms for relevant staff.	Admission decisionsCoverageOutcomesBreak-glass events
Article 10(3)	Resources to monitor activity and anomalies Financial entities shall devote sufficient resources and capabilities to monitor user activity, the occurrence of ICT anomalies and ICT-related incidents, in particular cyber-attacks.	Evidence chainAdmission decisionsBreak-glass events
Article 11(1)	ICT business continuity policy Financial entities shall put in place a comprehensive ICT business continuity policy as an integral part of their operational business continuity policy, to ensure continuity of critical or important functions.	Availability
Article 28(4)	Due diligence before entering a third-party arrangement Before entering into a contractual arrangement on the use of ICT services, financial entities shall identify and assess all relevant risks, and undertake all due diligence on prospective ICT third-party service providers.	Supply chainControl statement
Article 28(5)	Providers shall meet appropriate information security standards Financial entities may only enter into contractual arrangements with ICT third-party service providers that comply with appropriate information security standards; where those services support critical or important functions, the most up-to-date and highest quality standards shall apply.	Supply chainControl statementCoverageAdmission decisionsOutcomes

7 clauses marked outside scope, and why

Citation	Clause and reason
Article 5	Governance and organisation the management body's approval, oversight and accountability are records of the entity, not of a cluster. The enforcement settings reproduced in the control statement are one output of that governance, not evidence of it.
Article 6	ICT risk management framework the framework is a document the entity maintains and reviews. This control operates inside it and produces evidence for parts of it; it is not the framework.
Article 12	Backup, restoration and recovery backup and restoration of the entity's systems and data are outside what an admission controller records. The operator's own database is the customer's to back up.
Article 13	Learning and evolving post-incident review is a practice carried out by people. The refusals, exceptions and outage windows in this document are inputs to such a review, not the review.
Articles 17 – 23	ICT-related incident management, classification and reporting classification against DORA's thresholds and reporting to a competent authority are decisions and filings made by the entity. This control raises and records events; it does not classify or file them.
Articles 24 – 27	Digital operational resilience testing the entity's testing programme, including threat-led penetration testing, is conducted against its estate by testers. Nothing a cluster records is evidence that it happened.
Article 28(3)	Register of information on contractual arrangements the register is a contractual record held by the entity. The image inventory in this document records what runs, not what was contracted.

What Attestkeep produces

Evidence from records the cluster already keeps.

Nothing is filled in by hand. Each clause's answer carries a status (met, partial, gap or outside scope), a note with the period's own numbers, and the report sections those numbers come from.

Statements the mapping draws on

Each assessed clause is answered by one or more of these statements about the period's records. The same statement answers the same question under every framework, so two reports for one period cannot disagree.

Every image in the inventory carries a scan record4 clauses
Images carrying severe findings are refused4 clauses
Only images of established provenance may run3 clauses
Images may enter only from named registries3 clauses
Every decision and administrative action is recorded2 clauses
The control itself was operating throughout the period2 clauses
Workloads name images by digest, not by a movable tag2 clauses
A refusal or a critical finding reaches a person2 clauses
A bill of materials is held for the images in service2 clauses
Administrative access is federated to a directory1 clause
Admission refuses non-compliant workloads1 clause
Remediation windows are declared for each severity1 clause
Workload privilege is constrained at admission1 clause

The package

What the report contains.

Every package carries the same sections, whatever the framework. The ones marked are those DORA answers cite, with the number of clauses citing each.

The scope paragraph, as the report states it.

This document reports what one Kubernetes cluster's admission control and image scanning recorded during the period, mapped onto the Digital Operational Resilience Act. DORA governs a financial entity's entire ICT risk management framework, of which a container image control is one instrument: it speaks to identification of ICT assets, to protection, prevention and detection under Articles 8 to 11, and to the point in Article 28 where third-party code enters the estate. Governance, testing, backup and the incident reporting owed to competent authorities are the entity's own and are marked outside the scope of this document rather than claimed.

Questions

About DORA and Attestkeep

Is this a DORA certification?

No. The package is evidence produced from your cluster's own records. It is not a certification, and no auditor is obliged to accept it. The scope paragraph on this page is the one the report itself carries.

Why are 7 of the clauses outside scope?

They ask about things one cluster's admission and scanning records cannot show. They are listed with the reason rather than left out, so whoever reads the report can see the gap is deliberate.

Which plan includes DORA?

Every plan can report against it. Community and Team include one framework of your choice, Business three, Enterprise every one. Prices are on the pricing page.

How does an auditor check the package?

In a browser at attestkeep.com/verify.html, where nothing is uploaded, or with the short script on the documentation site. Neither needs us. For auditors has the details.

DORA (Digital Operational Resilience Act)