Claude 
Cursor 
Codex 
Hugging Face 
NVIDIA 
Visual Studio Code 
Devin 
Kiro 
Open Code 
NanoClaw 
Docker 
npm 
PyPy 
Wiz 
Financial Services 
Gaming 
Public Sector 
Automotive 
Technology 
Healthcare 
Take Control of EU DORA Compliance
The Digital Operational Resilience Act (DORA) holds your management body ultimately responsible for managing ICT risk, and regulators can request proof at any time. With JFrog, each release can carry its evidence trail before anyone asks.
The Cost of Getting DORA Wrong
Puts Your Leadership on the Record
Where national law allows, regulators can penalize management body members and publish who was responsible. That public record will remain long after the fine is paid.
Lose Customers You Can't Win Back
Regulators can force you to halt practices that breach DORA and announce the breach publicly. Customers who leave over a public breach notice are hard to win back.
Burn Engineering Cycles on Emergency Fixes
If regulators find gaps in how you track third-party components, remediation can run on the regulator’s timeline. Developers can get pulled off strategic roadmaps to manually reconstruct evidence trails, turning routine delivery into an expensive emergency.
Your Current Processes Have Three Gaps DORA May Expose
Your change ticket is approved. Can you show the security evidence?
DORA requires documented proof that every ICT change was security-tested and independently approved before promotion. A ticket with a sign-off tells a regulator almost nothing about whether exploitable vulnerabilities were present when it shipped.
A new critical CVE is disclosed. Do you know which releases contain that package?
DORA requires financial entities to track their use of third-party libraries, including open-source libraries, used by ICT services supporting critical or important functions, and to monitor versions and updates. Without continuous tracking, a scan at package import says little about which releases are affected when a new CVE is disclosed six months later.
Your incident record starts after the alert. What was deployed and who approved it? DORA mandates context.
DORA requires financial entities to log every ICT-related incident and significant cyber threat with root causes identified, documented, and addressed, and to report major incidents to financial regulators. Assembling that record from scattered tool outputs after the fact invites errors, missed classifications, and a report your regulator can challenge.
Govern DORA Requirements Across Your Software Supply Chain
Find the DORA obligation your team owns. See what JFrog supports and what evidence backs it.
ICT Change Management
ICT change records, security testing evidence, and independent approval confirmation across every release. (DORA Article 9(4))
Security-Gated Change Records
JFrog can attach CVE scan results, SAST evidence, and VEX records at the promotion gate, check for unresolved critical vulnerabilities or a recorded exception, and confirm an independent approver signed off.
Source Code and Component Integrity
Source code integrity, build provenance records, and vulnerability action plan tracking through deployment. (DORA Article. 9(2))
Provenance and Integrity Evidence
JFrog can attach SLSA provenance records for in-house and third-party source code, VEX evidence confirming components were analyzed before deployment, and Jira-linked action plans showing vulnerabilities are tracked to closure.
Vulnerability and Patch Management
Continuous vulnerability scanning, third-party and open-source library tracking, and patch exception records. (DORA Article 9(4))
Continuous Component Tracking
JFrog can run continuous vulnerability scans across software artifacts, track third-party and open-source library versions per release, check for patches or recorded exceptions for critical findings, and maintain third-party provider security review records as evidence.
Resilience Testing
Resilience testing evidence, vulnerability assessment results, and open-source analysis per release. (DORA Article 25)
Test Evidence Per Release
JFrog can attach test plan evidence your team scopes against the ICT risk landscape and asset criticality, store vulnerability assessment and scan results for critical systems per release, and attach open-source analysis results via VEX and SAST tooling.
Incident Management and Business Continuity
Incident management records, DR/BCP simulation evidence, and roles and responsibilities documentation per release. (DORA Article 11)
Incident and Continuity Records
JFrog can store your incident response playbook, incident log, roles and responsibilities documentation, and DR/BCP simulation records as evidence linked to each release, so the evidence exists before an incident requires it.
Governance and Risk Framework
ICT governance documentation, segregation-of-duties records, and risk assessment methodology per release. (DORA Articles 5 & 6)
Governance and Role Evidence
JFrog can store, as evidence, the information security roles and responsibilities document, the segregation-of-duties record for your ICT risk management control function, the third-party monitoring role designation, and the risk assessment methodology.
Asset Classification and Risk Identification
Asset classification records, yearly classification review evidence, and risk scenario review records. (DORA Article 8)
Classified Asset and Risk Records
JFrog can store, as evidence, the data classification document covering ICT-supported business functions and their dependencies, records of the yearly classification review, and risk scenario review records documenting the annual review.
From DORA Requirement to Traceable Evidence in JFrog AppTrust
Enforce Pre-Mapped DORA Policies From Day One
AppTrust delivers pre-mapped policies as code for DORA requirements. Instead of building rules from scratch, your team can enable relevant guardrails across your software supply chain and track active policy enforcement through real-time coverage scoring.
Block Releases That Fail Your Controls Before They Ship
Customizable policy gates evaluate each promotion against the controls you map to DORA. Releases that fail your controls are blocked from promotion until the issue is resolved or a waiver is approved, whether the issue is an unresolved CVE, a missing approval, or a failed resilience test.
Pull Any Release’s Evidence From One Place
AppTrust collects signed evidence from your connected tools, including CVE scan results, SAST output, VEX records, and provenance records, and binds it to one application version. When a regulator or auditor asks, evidence is already waiting, eliminating fire drills and repeated evidence requests to your dev teams.
Go Deeper on DORA Compliance
Navigating DORA Compliance: Software Development Requirements for Financial Services Companies
Frequently Asked Questions
DORA entered into force in January 2023 and became fully applicable on 17 January 2025. Its requirements apply now to the financial entities it covers, and those entities remain fully responsible for their obligations when they rely on ICT third-party service providers.
It depends on your organization’s role. DORA applies to the types of financial entities it lists, which are generally tied to EU authorization. Providers outside the EU that serve those entities are typically affected through contract requirements, and a provider designated as critical faces direct EU oversight. Your legal advisers can confirm how DORA applies to you.
JFrog can store your incident response playbook, incident log, and DR/BCP simulation records as evidence attached to each release. When an incident occurs, your team starts from evidence that already exists. Classification, escalation, and regulatory notification stay with your team.
JFrog can generate, collect, and store the software supply chain evidence that feeds into your DORA documentation: CVE scan results, VEX records, SAST output, SLSA provenance, and policy sign-offs attached to each release. Narrative documents such as your ICT risk management framework, business continuity plan, and risk appetite statement require authorship from your team.
DORA obligations sit with the financial entity, so no platform makes you compliant on its own. JFrog does not perform conformity assessments, issue certifications, or set your risk tolerance. JFrog provides the software supply chain visibility, security intelligence, and evidence chain that support your compliance program.
