What this page covers
DORA incident evidence should show what happened, who acted, which service was affected and when recovery evidence was produced.
Legal timing
DORA has applied since 17 January 2025 for financial entities and relevant ICT providers. Incident, resilience testing and third-party evidence should be reviewable over time.
This page is implementation guidance for evidence planning, not legal advice.
Evidence Attesto AI can preserve
incident timeline
remediation action
supplier attestation
access event
auditor verification receipt
Example evidence records
Example proof receipt
Example Attesto receipt
event_type
DORAINCIDENT
timestamp
2026-06-04T10:21:00Z
leaf_hash
sha256:8f41...b19e
merkle_root
sha256:52ac...91d4
verification_status
valid demo receipt, raw data not exposed
Where Attesto fits
Attesto seals incident evidence from SIEM, ITSM and supplier workflows so the packet can be checked later.
FAQ
How is this different from a normal log?
A normal log asks an auditor to trust the system that produced it. Attesto records hashes, signatures, Merkle proofs and verifier receipts so selected evidence can be checked independently.
Does Attesto need to expose raw sensitive data?
No. Raw records can remain encrypted or customer-controlled while proof material is shared for verification.
Where does DORA ICT incident evidence fit in the compliance stack?
Attesto seals incident evidence from SIEM, ITSM and supplier workflows so the packet can be checked later.