The DORA Compliance Cloud Architecture Checklist is a free 35-point assessment that financial entities and ICT third-party providers use to evaluate whether their cloud infrastructure meets the EU Digital Operational Resilience Act (Regulation EU 2022/2554). It maps across six sections — workload portability and exit-readiness, concentration risk, operational resilience, sovereignty and supervisory access, third-party risk and contracting, and risk management and incident handling (the ICT risk-management framework of Articles 5-16 and incident classification and reporting under Articles 17-19, with major-incident reporting under Article 19). Ænix uses it during DORA-aligned readiness engagements. It pairs with Ænix Private Cloud Platform, built on Cozystack (CNCF Sandbox project, Apache 2.0), which supplies opt-in volume encryption, API audit logging with configurable retention that you can ship to your own immutable store, Tenant CRD multi-tenancy you can align with ICT risk classification, and an exit you can rehearse because workloads stay standard Kubernetes objects and virtual machines. Ænix claims no DORA certification: none exists for a platform.
A 35-point checklist for financial entities and ICT third-party providers evaluating DORA compliance posture for their cloud infrastructure. Covers the ICT risk-management framework (Articles 5-16), incident classification and reporting (Articles 17-19), resilience testing and TLPT (Articles 24-27), ICT third-party risk, exit strategies and key contractual provisions (Articles 28-30), encryption and audit-readiness. Used by Ænix during DORA-aligned readiness engagements.
Pairs with: Ænix Private Cloud Platform — built to supply the platform-side controls a DORA programme draws on: opt-in volume encryption, audit logging with configurable retention that you can ship to your own immutable store, Tenant CRD multi-tenancy you can align with ICT risk classification, an open supplier record, and an exit you can rehearse. See the DORA evidence page for what it does and does not cover.
What’s in the checklist
6 sections covering 35 specific control checkpoints:
- Workload portability and exit-readiness (5 checkpoints) — exit strategies under Articles 28(8) and 30(3)(f)
- Concentration risk (4 checkpoints) — Articles 28 and 29
- Operational resilience (5 checkpoints) — resilience testing under Articles 24-27, including threat-led penetration testing
- Sovereignty and supervisory access (5 checkpoints)
- Third-party risk and contracting (4 checkpoints) — Articles 28-30
- Risk management and incident handling (12 checkpoints) — the ICT risk-management framework of Articles 5-16 (Article 6 in particular) and incident classification, reporting and handling under Articles 17-19
The PDF closes with architecture-level recommendations and a generic reference pattern; they describe what the Ænix platforms actually provide: volume encryption at rest is opt-in (LINSTOR and LUKS) with a passphrase you hold, and the key-management process is designed with you; audit logs have configurable retention (default 30 days) and can be shipped to your own immutable store; DR is backup and restore with Velero plus rehearsed runbooks, with no SRM-style orchestrated cross-site failover. The next step it offers is the Platform Readiness Assessment of 14 or 28 days. The DORA evidence page goes control by control.
35-point self-assessmentArticles 5-16 + 17-19Free PDF
feeds
DORA-aligned readiness engagementUsed by Ænix
prepares
Supervisor dialogExit-readiness you can evidence
Who uses this
- CISOs at financial entities preparing supervisor dialog
- Cloud architects at ICT third parties serving financial sector
- Compliance teams scoping DORA-readiness engagements
- Procurement preparing RFI for DORA-aligned services
After downloading
The checklist gives you the working surface to assess your current cloud architecture against DORA. For full DORA-aligned engagement see DORA compliance services page.
Ænix created Cozystack (a CNCF Sandbox project) and co-maintains it with maintainers from other companies. On top of it, Ænix offers three platforms — Public Cloud, Private Cloud and AI.
Frequently asked questions
What is DORA and who must comply?
DORA (the Digital Operational Resilience Act, Regulation EU 2022/2554) is EU legislation on ICT risk for the financial sector. It applies to financial entities such as banks, insurers, and payment firms. Their ICT third-party providers, including cloud and infrastructure vendors, are drawn in through the contract and third-party risk rules of Articles 28-30, and providers designated as critical are overseen directly under Articles 31-44.
What does the checklist cover?
It contains 35 control checkpoints across six groups: workload portability and exit-readiness (5), concentration risk (4), operational resilience (5), sovereignty and supervisory access (5), third-party risk and contracting (4), and risk management plus incident handling (12). Checkpoints carry the DORA article they map to - Articles 28(8) and 30(3)(f) for exit strategies, Article 29 for concentration risk, Articles 5-16 for the ICT risk-management framework, Articles 17-19 for incident classification and reporting, and Articles 26-27 for threat-led penetration testing.
Is the checklist free to download?
Yes. The checklist is a free PDF lead magnet. You request it through the form on this page and receive a download link. Ænix also uses the same checklist during paid DORA-aligned readiness engagements.
How does Ænix Private Cloud Platform help with DORA compliance?
It supplies platform-side controls a DORA programme leans on, not compliance itself — DORA binds financial entities, not platforms, and there is no DORA certificate to hold. Ænix Private Cloud Platform is built on Cozystack and gives you opt-in volume encryption, API audit logging with configurable retention (30 days by default) that you can ship to your own immutable store, Tenant CRD multi-tenancy you can map to ICT risk classification, an open supplier record, and an exit you can rehearse rather than one promised in a clause. The control-by-control detail, including what the platform does not provide, is on the DORA evidence page.
Does the checklist replace a formal DORA audit?
No. It is a self-assessment working surface to evaluate your current cloud architecture and prepare for supervisor dialog. For a full engagement, see the DORA compliance services page on aenix.io.
Is Cozystack open source and what is its licensing model?
Cozystack is open source under Apache 2.0 with no per-CPU or per-core licensing, and is a CNCF Sandbox project. Ænix Private Cloud Platform, built on it for regulated organisations, is quoted per RFP after a Platform Readiness Assessment; support tiers for self-run Cozystack start at $1,250 per 10 nodes per month.
