What we can evidence today and what is in preparation
Regulation requires knowing the impact of outages on services, reporting major incidents within deadlines and keeping an overview of ICT services and providers. Without a reliable dependency map this is manual work.
Available today
- A dependency map from business service to infrastructure and redundancy-aware impact calculation
- An owner for every service, scoped roles and a RACI matrix checked against permissions
- An immutable five-year audit trail, with before and after state for configuration
- Managed changes with approval, maintenance windows and freezes
- Service contracts and vendor SLAs, incident escalation to the vendor
- Vulnerabilities by service with deadlines by severity
- Incidents with affected services and major incidents
In preparation In preparation
- Major incident classification against NIS2 and DORA criteria, from the impact in the CMDB
- A pre-filled report for the national authorities
- A register of ICT services and providers under DORA
How it will work
The Classification and Report steps are in preparation. We will confirm the timing with pilot customers.
Incident and impact
Affected services and their criticality from the dependency map.
Classification
Assessment against the major incident criteria.
Report
A pre-filled report with timeline and impact.
Decision
A person always reviews and submits.
CentOps does not replace legal assessment. Review your NIS2 and DORA obligations with your compliance team.
Mapping to COBIT 2019 objectives
For governance and audit: which COBIT 2019 management objectives CentOps supports and in which modules.
| Objective | Modules |
|---|---|
| APO03 Managed enterprise architecture | Enterprise architecture |
| APO06 Managed budget and costs | Costs and billing |
| APO09 Managed service agreements | SLAs and availability |
| APO10 Managed vendors | Contracts and suppliers |
| APO12 Managed risk | Availability and resilience, Changes and maintenance windows |
| BAI06 Managed IT changes | Changes and maintenance windows, Approvals |
| BAI09 Managed assets | IT assets and procurement, Licences and spare parts |
| BAI10 Managed configuration | Configuration database, Dependency map and impact |
| DSS01 Managed operations | Monitoring and events, Data centres and racks |
| DSS02 Managed service requests and incidents | Incidents, Requests and service catalogue, War room |
| DSS03 Managed problems | Problems and known errors |
| DSS04 Managed continuity | Availability and resilience |
| DSS05 Managed security services | Patching and vulnerabilities, Roles, security and audit |
| MEA01 Managed performance and conformance monitoring | SLAs and availability, Roles, security and audit |
Frequently asked questions
Does CentOps help with NIS2 and DORA compliance?
It provides the data foundation: a dependency map with impact calculation, an owner for every service, roles and RACI, managed changes, vendor contracts and SLAs, vulnerabilities by service and an immutable audit trail. It does not replace legal assessment.
Can CentOps prepare a major incident report?
Not yet. Major incident classification against NIS2 and DORA criteria and a pre-filled report are in preparation. A person will always review and submit.
Does CentOps keep a DORA register of ICT services and providers?
The DORA register is in preparation. CentOps already records services, vendors, service contracts and vendor SLAs, which the register will build on.
How long is the audit trail kept?
Five years. Records cannot be changed or deleted earlier, and for configuration the state before and after each change is stored.
Start with a pilot in one area.
Pick a customer or a department and its key services. After the pilot we review SLAs, changes and costs together – and you decide on expansion with peace of mind.