Dashboard

What needs my attention today?

Today, 26.09.2026

ICT vendors

14

5 critical

Qualifications in progress

6

2 awaiting RO

Contracts audited

9 / 12

7 compliant

My tasks

Review risk assessment (Annex 3) — Northbridge ITStep 2.1 · sent for review by BO · yesterday
RO
Draft security standard (3.1) — CloudNordicStep 3.1 · due today
RO
Approve qualification (6.2) — Halden Systems S.A.Step 6.2 · approved by BO
RO
Re-check qualification (6.1) — Meridian SoftwareNew Annex 5 audit — approvals expired
overdue

Alerts

Contract not DORA-compliant — Northbridge ITAnnex 5: 4 × NO · do not sign
Contract
Risk outside tolerance — Meridian SoftwareLegal risk: residual 3 > limit 1
Risk
Re-verification due within 30 daysCloudNordic · 18.10.2026
Review
Re-verification overdueNordic Data Center · 02.09.2026
Review

Notifications

All events in your organisation · 8 unread

Mark all as read

BO sent the risk assessment for review — Northbridge ITTask: Review risk assessment (Annex 3) · 25 min ago
RO
New Annex 5 audit — Meridian SoftwareEarlier 6.1 / 6.2 approvals expired · 2 hrs ago
6.1
Approval 6.2 — Halden Systems S.A.BO approved the qualification results · yesterday
RO
Contract flagged as non-compliant — Northbridge ITContract audit completed: do_not_sign · yesterday
Contract
Stage ③ started — CloudNordicStep 3.1 to be completed by RO · 2 days ago
3.1
Monitoring plan generated — Nordic Data Center4 measures, first tasks due 30.10 · 3 days ago
info
Role changed: BO → ROAn administrator changed your role · 5 days ago
info

Reports

Compliance and Management Board reports

Generator

Report type

ICT vendor qualification report ▾

Vendor

Halden Systems S.A. ▾

Scope

Stages ①–⑥ · Annex 5 · gap register

Generate report (PDF)

The Management Board report covers new, critical ICT vendors only.

History

Qualification report — Halden Systems S.A.24.09.2026 · BO · complete (6/6)
PDF
Contract audit (Annex 5) — Northbridge IT23.09.2026 · critical variant (17 points) · non-compliant
PDF
Management Board report20.09.2026 · 2 new critical vendors
PDF
Qualification report — CloudNordic12.09.2026 · partial (4/6)
PDF

Register of information

DORA Art. 28(3) — ITS templates filled from vendors, contracts and functions

Export for the supervisor (xBRL-CSV)

Templates complete

5 / 7

2 with gaps

Fields filled

86%

412 of 479

Validation

3

errors to fix

Template	Content	Rows	Completeness	Status
B_01.01	Entity maintaining the register	1	100%	complete
B_02.01	Contractual arrangements	12	75%	gaps
B_03.01	Entities signing the arrangements	12	100%	complete
B_04.01	Entities using the ICT services	18	100%	complete
B_05.01	ICT third-party service providers	14	79%	3 errors
B_06.01	Functions	19	100%	complete
B_07.01	Assessment of the ICT services	9	100%	complete

Vendors

ICT vendors — qualification, risk and contract status, plus the register of information (DORA Art. 28(3), B_05.01)

+ Add vendor

All 14In qualification 6Verified 7Action needed 3

Vendor	Qualification	Risk (Annex 3)	Contract compliance	BO	Next review	Register
Northbridge IT critical	Stage 6/6 — contract on hold	acceptable	non-compliant	J. Wiśniewski	—	16/20
Halden Systems S.A. critical	verified	acceptable	compliant	A. Kowalska	24.09.2027	20/20
CloudNordic non-critical	Stage 3/6	acceptable	—	A. Kowalska	—	11/20
Meridian Software critical	Stage 6/6 — re-approval	outside tolerance	partially compliant	J. Wiśniewski	—	18/20
Nordic Data Center non-critical	verified	acceptable	compliant	P. Nowak	02.09.2026 — overdue	14/20
Orbis Networks non-critical	Stage 1/6	—	no contract	J. Wiśniewski	—	3/20

Documents

ICT contracts and documents — audit status and register of information (DORA Art. 28(3), B_02)

Upload document (PDF / DOCX)

Contracts 12Other documents 19

File	Vendor	Type	Audit status	Compliance	Signed	Register
ICT_Contract_Halden_2026.pdf	Halden Systems S.A.	contract	audited	compliant	24.09.2026	12/12
Northbridge_MSA_draft.docx	Northbridge IT	contract	audited	non-compliant	—	7/12
Meridian_contract_v3.pdf	Meridian Software	contract	in progress	—	—	9/12
SLA_CloudNordic.pdf	CloudNordic	draft contract	pending	—	—	4/12
NDC_contract_2024.pdf	Nordic Data Center	contract	audited	compliant	02.09.2024	11/12

Functions

Critical and non-critical functions — register of information (B_06.01). Qualification step 1.4 reads criticality from here.

+ Add function

Code	Function	Criticality	Supporting vendors	Licence / legal basis
F2	Information security	critical (CIF)	Halden Systems S.A., Meridian Software	DORA Art. 3(22)
F6	IT operations	critical (CIF)	Northbridge IT, CloudNordic	DORA Art. 3(22)
F7	Finance and accounting	critical (CIF)	Northbridge IT	DORA Art. 3(22)
F12	Customer service	non-critical	Nordic Data Center	—
F16	Project and portfolio management	under assessment	—	—
F19	Marketing and communications	non-critical	—	—

Tasks

Tasks assigned to you and your role (RO)

Open 4Completed 17All

Review risk assessment (Annex 3) — Northbridge ITStep 2.1 · created yesterday · from: Jan Wiśniewski (BO)
ROOpen step
Draft security standard (3.1) — CloudNordicStep 3.1 · due today
ROOpen step
Approve qualification (6.2) — Halden Systems S.A.Step 6.2 · approved by BO on 24.09
ROOpen step
Re-check qualification (6.1) — Meridian SoftwareThe contract changed (new Annex 5 audit) — 6.1 / 6.2 approvals expired
overdueOpen step

Monitoring

What’s changing and what’s expiring — stage bottlenecks and the re-verification schedule

overdue or due within 30 days: 2

Qualifications by stage

① Identification

1

② Risk assessment

2

③ Requirements

1

④ Contract review

0

⑤ Final assessment

0

⑥ Approval

2

Re-verification schedule

Nordic Data Centerlast: 02.09.2024 · every 24 months
overdue
CloudNordiclast: 18.10.2025 · every 12 months
in 22 days
Halden Systems S.A.last: 24.09.2026 · every 12 months
24.09.2027
Northbridge ITqualification not completed
—

Risk assessment

Annex 3 — inherent and residual risk per ICT vendor, against the tolerance set by the Management Board

+ New assessment

All 9Outside tolerance 1Awaiting RO 2

Vendor	Risk area	Inherent	Residual	Tolerance	Result	Status
Meridian Software	Legal	4	3	1	outside tolerance	re-approval
Northbridge IT	Concentration	4	2	2	acceptable	awaiting RO
CloudNordic	Data location	3	2	2	acceptable	awaiting RO
Halden Systems S.A.	Operational	3	1	2	acceptable	approved
Nordic Data Center	Business continuity	2	1	2	acceptable	review overdue

Settings

Profile, role and organisation

Profile

Full name

Marta Zielińska

E-mail

marta.zielinska@example.com

Role in organisation

RO · Risk oversight officer

Interface language

English ▾

Notifications

In-app notificationsTasks and events for your role
E-mailReceive e-mail notifications
Weekly summaryMonday, 8:00

Organisation

Example S.A.LEI 259400… · 6 users · 3 roles assigned
active