# NIS2 and DORA in IT operations: what you can evidence today · CentOps

> A dependency map, service owners, managed changes and an immutable audit trail as the foundation for NIS2 and DORA.

URL: https://centops.eywo.digital/en/nis2-dora/
Language: en
Last updated: 2026-10-30

NIS2 and DORA

# What we can evidence today and what is in preparation

Regulation requires knowing the impact of outages on services, reporting major incidents within deadlines and keeping an overview of ICT services and providers. Without a reliable dependency map this is manual work.

### Available today

-   A dependency map from business service to infrastructure and redundancy-aware impact calculation
-   An owner for every service, scoped roles and a RACI matrix checked against permissions
-   An immutable five-year audit trail, with before and after state for configuration
-   Managed changes with approval, maintenance windows and freezes
-   Service contracts and vendor SLAs, incident escalation to the vendor
-   Vulnerabilities by service with deadlines by severity
-   Incidents with affected services and major incidents

### In preparation In preparation

-   Major incident classification against NIS2 and DORA criteria, from the impact in the CMDB
-   A pre-filled report for the national authorities
-   A register of ICT services and providers under DORA

NIS2 and DORA

## How it will work

The Classification and Report steps are in preparation. We will confirm the timing with pilot customers.

01

### Incident and impact

Affected services and their criticality from the dependency map.

02

### Classification

Assessment against the major incident criteria.

03

### Report

A pre-filled report with timeline and impact.

04

### Decision

A person always reviews and submits.

CentOps does not replace legal assessment. Review your NIS2 and DORA obligations with your compliance team.

COBIT 2019

## Mapping to COBIT 2019 objectives

For governance and audit: which COBIT 2019 management objectives CentOps supports and in which modules.

Objective

Modules

APO03 Managed enterprise architecture

[Enterprise architecture](https://centops.eywo.digital/en/features/#ea)

APO06 Managed budget and costs

[Costs and billing](https://centops.eywo.digital/en/features/#costs)

APO09 Managed service agreements

[SLAs and availability](https://centops.eywo.digital/en/features/#sla)

APO10 Managed vendors

[Contracts and suppliers](https://centops.eywo.digital/en/features/#contracts)

APO12 Managed risk

[Availability and resilience](https://centops.eywo.digital/en/features/#resilience), [Changes and maintenance windows](https://centops.eywo.digital/en/features/#change)

BAI06 Managed IT changes

[Changes and maintenance windows](https://centops.eywo.digital/en/features/#change), [Approvals](https://centops.eywo.digital/en/features/#approvals)

BAI09 Managed assets

[IT assets and procurement](https://centops.eywo.digital/en/features/#itam), [Licences and spare parts](https://centops.eywo.digital/en/features/#licenses)

BAI10 Managed configuration

[Configuration database](https://centops.eywo.digital/en/features/#cmdb), [Dependency map and impact](https://centops.eywo.digital/en/features/#map)

DSS01 Managed operations

[Monitoring and events](https://centops.eywo.digital/en/features/#events), [Data centres and racks](https://centops.eywo.digital/en/features/#dc)

DSS02 Managed service requests and incidents

[Incidents](https://centops.eywo.digital/en/features/#incidents), [Requests and service catalogue](https://centops.eywo.digital/en/features/#requests), [War room](https://centops.eywo.digital/en/features/#warroom)

DSS03 Managed problems

[Problems and known errors](https://centops.eywo.digital/en/features/#problem)

DSS04 Managed continuity

[Availability and resilience](https://centops.eywo.digital/en/features/#resilience)

DSS05 Managed security services

[Patching and vulnerabilities](https://centops.eywo.digital/en/features/#patch), [Roles, security and audit](https://centops.eywo.digital/en/features/#gov)

MEA01 Managed performance and conformance monitoring

[SLAs and availability](https://centops.eywo.digital/en/features/#sla), [Roles, security and audit](https://centops.eywo.digital/en/features/#gov)

Questions and answers

## Frequently asked questions

### Does CentOps help with NIS2 and DORA compliance?

It provides the data foundation: a dependency map with impact calculation, an owner for every service, roles and RACI, managed changes, vendor contracts and SLAs, vulnerabilities by service and an immutable audit trail. It does not replace legal assessment.

### Can CentOps prepare a major incident report?

Not yet. Major incident classification against NIS2 and DORA criteria and a pre-filled report are in preparation. A person will always review and submit.

### Does CentOps keep a DORA register of ICT services and providers?

The DORA register is in preparation. CentOps already records services, vendors, service contracts and vendor SLAs, which the register will build on.

### How long is the audit trail kept?

Five years. Records cannot be changed or deleted earlier, and for configuration the state before and after each change is stored.

Next step

## Start with a pilot in one area.

Pick a customer or a department and its key services. After the pilot we review SLAs, changes and costs together – and you decide on expansion with peace of mind.

[Choose an edition →](https://centops.eywo.digital/en/editions/)