%201.svg)
HIPAA Compliance Checklist for 2025
Two weeks before its March 31 deadline, Luxembourg's CSSF reported that only 40% of entities had filed their DORA Register of Information. These were teams on their second annual cycle, templates already in hand.
The register is more than a filing now. The ESAs used registers to designate 19 critical ICT third-party providers in November 2025, so what you submit shapes European supervision.
Roundups of DORA compliance software ask whether a tool can export the register. The harder question is what goes into it: Article 28(3) of DORA covers all contractual arrangements for ICT services, and the ones most likely to be missing never passed through procurement.
So this list judges seven tools on two jobs: finding every ICT arrangement, and turning that inventory into the reports DORA demands.
What Does DORA Compliance Software Need to Cover in 2026?
DORA compliance software has to support five pillars, and no single platform does all five equally well. Most financial entities pair one system of record with specialist tooling where the regulation is most prescriptive.
The register follows a fixed relational template set by Implementing Regulation (EU) 2024/2956. It links entities, contracts, providers, supported functions and subcontracting chains, so one broken link sends the file back for correction.
Why Is the DORA Register of Information Often Incomplete?
Registers usually start from the procurement system and the vendor master. Both miss ICT services that never went through procurement in the first place.
In a SaaS-heavy business, ICT arrangements enter through doors procurement rarely watches:
- Tools bought on a corporate card or expensed, with click-through terms instead of a negotiated contract
- Free tiers that turn paid when one team upgrades
- AI assistants and browser extensions adopted team by team
- OAuth-connected apps holding tokens into core systems
- Subprocessors and fourth parties sitting behind a sanctioned vendor
Whether each of these belongs in your register depends on how your entity scopes ICT services and the functions they support. That call sits with compliance; knowing the tools exist before making it is not optional.
Our take: a register built from the vendor master lists what procurement approved, not what the business runs. Discovery has to come before reporting.
How Did We Evaluate These DORA Compliance Tools?
We scored each platform on five criteria drawn from the regulation and from the guides currently ranking for this topic:
- Register of Information output in the ESA template, with checks before submission
- Inventory completeness: how the tool finds ICT services and contracts beyond manual entry
- Third-party depth: assessments, criticality, subcontracting and exit planning
- Coverage of the other pillars: ICT risk, incidents and testing
- User proof: G2 rating and review volume, checked in October 2026
Every vendor here quotes pricing on request, so cost is noted only where it is public.
Which DORA Compliance Software Is Worth Shortlisting?
CloudEagle.ai ranks first because a register tool can only file what it is given, and CloudEagle.ai finds the arrangements nobody listed. The six after it are the reporting and controls tools worth pairing with it.
1. CloudEagle.ai
CloudEagle.ai is an AI-powered SaaS management, AI governance and SaaS security platform. It gives enterprises one command center to discover, secure, govern and optimize their SaaS and AI stack, including AI usage and both human and non-human identities. RingCentral, Automation Anywhere, Shiji and Rec Room use it, and it connects to 500+ apps with onboarding in about 30 minutes.
For DORA, that makes it the inventory your Register of Information should start from. It finds every SaaS app, AI tool and contract in use, including the ones procurement never approved.
Where It Fits for DORA
- Discovers sanctioned and shadow AI and SaaS by correlating SSO, finance and card spend, browser and firewall signals across 500+ integrations
- Pulls renewal dates, opt-out windows and pricing terms from uploaded agreements with AI contract metadata extraction, so contract fields are not retyped from PDFs
- Scores every vendor on security and GenAI risk signals, including AI training exposure, MFA and SSO support, and certifications
- Runs user access reviews with deprovisioning evidence attached, supporting the access-control expectations in DORA's ICT security rules
- Governs non-human identities, the service accounts, API keys and AI agents that ICT integrations create
A financial services CISO reviewing it on G2 summed up the first scan: it "gave us a number we could actually reduce."
Where It Falls Short
CloudEagle.ai does not generate the ESA register file, classify incidents or run resilience tests, so pair it with a reporting tool below.
Rating and Pricing
G2 rates it 4.7 out of 5 from 107 reviews. Pricing is custom, and first insights arrive within about 30 minutes of onboarding.
Map Your ICT Inventory Before the Next Cycle
2. Formalize
Formalize is the most register-centric tool on this list. It is organized around DORA's own structure and produces the official Register of Information sheets in one click.
Where It Fits for DORA
- Ships templates for the 15 official register sheets and generates ITS-compliant outputs in one click
- Flags inconsistencies before submission; G2 reviewers in insurance and banking credit it for registers filed with BaFin and the FMA in Liechtenstein
- Pre-fills register fields from uploaded contracts using AI, according to a 2026 G2 review
- Covers ICT risk, incident records and supplier audits alongside the register
One BaFin-supervised reviewer put the case plainly: the regulator's own Excel template was a poor fit for building the register, and Formalize filled that gap.
Where It Falls Short
The register is only as complete as the supplier list you enter. Reviewers also mention a learning curve, and one notes you need to understand DORA's logic to follow the tool's.
Rating and Pricing
G2 rates it 4.8 out of 5 from 44 reviews. Pricing is on request.
3. 3rdRisk (Now Part of Diligent)
3rdRisk is a Netherlands-built third-party risk platform that Diligent acquired in January 2026. It now sits inside Diligent's GRC suite, next to board and audit workflows.
Where It Fits for DORA
- Built around EU third-party regimes such as DORA and NIS2
- Automates vendor profiling, assessment workflows and document analysis of contracts and certifications
- Connects vendor risk to board-level reporting through Diligent
Where It Falls Short
Public proof is thin, with nine G2 reviews, and the post-acquisition roadmap is still settling. Scope is third-party risk, so incidents and testing need another tool.
Rating and Pricing
G2 rates it 4.6 out of 5 from 9 reviews. Pricing is on request.
4. OneTrust
OneTrust fits groups that already run privacy and vendor risk on one platform. It announced two-click register generation inside its Third-Party Management product in September 2024.
Where It Fits for DORA
- Generates the register across ICT providers and their service supply chains
- Adds pre-contract ICT assessments and ICT risk treatment workflows
- Shares data with privacy programs, useful where personal data in ICT contracts also triggers GDPR
Where It Falls Short
It is an enterprise implementation. G2 users of OneTrust Tech Risk & Compliance report an average 22 months to return on investment, and its Third-Party Management listing has only six reviews.
Rating and Pricing
G2 rates Tech Risk & Compliance 4.5 out of 5 from 109 reviews. Pricing is on request.
Assessing vendors before they reach the register? Our vendor risk assessment guide covers the criteria that matter for SaaS providers.
5. ServiceNow GRC
ServiceNow suits banks and insurers whose IT already runs on it. Its Digital Resilience Third-party Information Register app keeps the register next to CMDB, vendor and ITSM data.
Where It Fits for DORA
- Generates and validates register packages from the Vendor Management Workspace, supported since release 19.1.x
- Ships an Excel template with every reporting tab, plus upload and download of individual DORA tables
- Links third-party records to the configuration data your IT teams already maintain
A detail from ServiceNow's own documentation worth knowing: the register output is a Microsoft Excel template with every reporting tab, so your team still reviews spreadsheets before filing.
Where It Falls Short
ServiceNow's documentation says the 19.1.x operational resilience release covers the ICT third-party pillar only. G2 users report an average of four months to implement.
Rating and Pricing
G2 rates ServiceNow GRC 4.2 out of 5 from 118 reviews. Pricing is on request.
6. Vanta
Vanta is the pick for SaaS and fintech companies that already run SOC 2 or ISO 27001 and now face DORA through regulators or customers.
Where It Fits for DORA
- Pre-maps DORA controls and tests them hourly across cloud, code, identity and device integrations
- Reuses evidence: Vanta puts the overlap at 50% for ISO 27001 and 40% each for SOC 2 and NIS 2
- Detects vendors, including shadow IT seen through IdP and SSO, and helps populate the register from ESA-aligned templates
- Payments firm BVNK moved from ISO 27001 to DORA in two months, per Vanta's case study
Where It Falls Short
Vendor discovery leans on IdP, SSO and device signals, so card-bought tools and personal-account AI use can slip past. G2 reviewers most often cite price and gaps in niche integrations.
Rating and Pricing
G2 rates it 4.6 out of 5 from 2,734 reviews. Pricing is on request.
7. Drata
Drata maps DORA into a control-centric library, which suits teams running DORA, ISO 27001 and NIS 2 from one control set.
Where It Fits for DORA
- Links ICT risks to DORA controls, owners and evidence
- Uses AI to explain failing control tests tied to DORA's ICT risk requirements
- Extends DORA controls to critical ICT providers and assesses them through third-party workflows
Where It Falls Short
Its DORA page does not describe a Register of Information export, so confirm that in a demo. Like Vanta, it is built for compliance automation rather than entity-wide operational resilience.
Rating and Pricing
G2 rates it 4.7 out of 5 from 1,397 reviews. Pricing is on request.
Which DORA Compliance Software Fits Your Organization?
Our recommendation is a two-tool stack: CloudEagle.ai for the inventory, Formalize for the filing. Swap Formalize for ServiceNow or OneTrust only if your group already runs them, and for Vanta or Drata if you are the SaaS vendor rather than the regulated entity.
Our scorecard below rates each tool from 1 to 5 against the five evaluation criteria. Scores are editorial judgments from public documentation and reviews, not hands-on tests.
How Does CloudEagle.ai Keep Your DORA Register Complete?
CloudEagle.ai closes the gap between what procurement approved and what the business actually runs. It works upstream of whichever register or GRC tool you file from.
- Discover every tool by correlating SSO, finance and card spend, browser and firewall data, so each SaaS app, AI tool and agent in use is listed, sanctioned or not
- Attach the contract, with renewal dates, terms and owners extracted from each agreement before it reaches the register
- Score each vendor on security and GenAI risk signals, so criticality reviews start from evidence rather than questionnaires alone
- Govern access through continuous reviews, automated offboarding and non-human identity controls, with audit-ready evidence attached
- Hand records off to the ITSM, TPRM and risk tools you already use through bi-directional integrations, so the register team works from one current source
Financial entities and fintechs use the SaaS security platform to keep that inventory live between filing cycles, not rebuilt each spring. See how financial services teams use it, or book a demo to map your ICT inventory before the next register cycle.
Frequently Asked Questions About DORA Compliance Software
What Is DORA Compliance Software?
DORA compliance software helps EU financial entities and their ICT providers meet the Digital Operational Resilience Act. It typically covers ICT risk, incident reporting, resilience testing and third-party risk, including the annual Register of Information.
Do SaaS Companies Need to Comply With DORA?
SaaS companies are not financial entities, so most are not directly regulated. They are still bound through Article 30 contract terms with financial customers, and designated critical providers face direct ESA oversight.
Can a Spreadsheet Handle the Register of Information?
A spreadsheet can work for a handful of providers, but the template links many tables through shared identifiers. Supervisors such as the CSSF return files with validation errors for correction and resubmission, which grows harder as contracts multiply.
A Register Is Only as Good as Its Inventory
.avif)
.avif)
.avif)
.png)
.avif)
.avif)
.avif)
