Whether you are a financial entity under DORA, an ICT provider to financial services, or navigating FCA operational resilience requirements — know where you stand today.
The compliance landscape for financial services
DORA is law for EU financial entities
The Digital Operational Resilience Act requires documented ICT risk management, an ICT incident register, and evidence of third-party risk oversight — for financial entities and their ICT providers.
FCA operational resilience requirements
UK firms must identify important business services, set impact tolerances, and test operational resilience annually. The FCA expects evidence, not assertions.
Cyber incident reporting obligations
DORA mandates prompt notification of major ICT-related incidents. Without a structured incident register and classification process, you're not ready.
AI-guided conversations covering the areas regulators actually ask about. Personalised PDF report with findings and prioritised actions.
ICT risk management, business continuity, backup and recovery, third-party vendor risk — covering the areas that map directly to DORA and FCA operational resilience expectations.
Free · No sign up required
A structured AI-guided audit across all 5 DORA chapters — scoped to your entity type (financial entity or ICT third-party provider). Evidence captured per control.
£99/mo · Portal subscription required
Compliance Navigator
Which regulations apply to your firm?
Map your obligations across DORA, FCA, PRA, GDPR, NIS2, and more. Free and instant — no account needed.
Risk register, incident log, evidence vault, and reporting — in one place, without the six-figure GRC platform price tag.
Findings & ICT Risk Register
Assessment findings populate your risk register. Track residual risk, ownership, and remediation progress in one place.
Incident Management
Log ICT-related incidents, classify severity, run structured response playbooks, and build the register DORA requires.
Evidence Vault
Every control backed by traceable evidence. Attach configuration exports, test results, and audit screenshots — ready for regulator review.
Quarterly Reporting
Auto-generated PDFs with score movement and AI narrative — suitable for sharing with senior management, board, or regulators.
Expert-quality regulatory compliance — without the waiting list, the day rates, or the enterprise GRC licence.
The DORA Readiness audit covers all 5 chapters and 22 controls with AI-guided conversation, per-control evidence capture, and a full results summary.
Built-in incident management lets you log, classify, and manage ICT incidents — and build the historical register DORA requires financial entities to maintain.
Every control is traceable to attached evidence. No more spreadsheets with "yes" against every row — actual proof, ready for inspection.
Quarterly reports with AI narrative show resilience posture improvement over time — exactly what senior management and regulators want to see.
Assessment responses are never used to train AI models, never sold, and never shared with third parties.
Fortify uses the Anthropic Claude API. Anthropic does not train on API data. Your responses generate your report and nothing else.
Your assessment responses and contact details are never sold to third parties or shared with any external organisation.
Assessments ask about your processes — not individuals. Avoid sharing personal data such as customer or staff details during the conversation.