OpenChainGraph Suite · CONTRACT A3 · arch #5

DORA Third-Party ICT Risk

Note (dated 2026-08-04): a chain composes independent computations performed in an analytical order. No step's output is carried into the next step by the execution model; each step computes from its own declared inputs. This is true of every chain on this site, including chains whose per-step copy below reads as a data handoff.

DORA ROI structure builder > DORA CIF identifier > DORA third-party contract checker > NIS2/DORA overlap mapper — composite DORA third-party ICT risk mandate.

OpenChainGraph · 4 Steps infrastructure mandate Hash-Anchored §4 chain_depth:4 Client-Side · Zero PII
Chain Topology — Dora Roi Structure Builder → Dora Cif Identifier → Dora Third Party Contract Checker → Nis2 Dora Overlap Mapper
§4 Execution Hash · Chain Definition Anchor
execution_hash:computing…
Market Rationale
Buyer: CISO / Head of Third-Party Risk at EU financial institution
Forcing function: DORA Jan 2025 in force; TLPT wave 2026-27; ECB critical ICT vendor register
Live Execution

This page is the chain definition (plan). To run the chain step by step in your browser, with each step's kernel executing in-page and a composite hash over the outputs, open the live runner:

▶ Run this chain in your browser
Chain Stages · 4 Steps
1 ROOT · D0 catalog
Dora Roi Structure Builder 301-dora-roi-structure-builder
ict_roi_framework and cost_benefit feed Stage 2 CIF identification
↓
2 D2 catalog
Dora Cif Identifier 302-dora-cif-identifier
cif_register and concentration_risk feed Stage 3 third-party contract checker
↓
3 D3 catalog
Dora Third Party Contract Checker 305-dora-third-party-contract-checker
contract_gaps and remediation_plan feed Stage 4 NIS2/DORA overlap mapper
↓
4 TERMINAL · D4 catalog
Nis2 Dora Overlap Mapper 309-nis2-dora-overlap-mapper
nis2_dora_overlap and dual_compliance_plan — final DORA third-party ICT mandate
▶ Run this chain (live) browser · real execution · composite §4 hash
Export Artifacts
Download the §4 chain definition artifact (hash-anchored composite JSON) or the §13.11 W3C Verifiable Credentials view. Both derive from the chain definition — no new hash is minted. Available after hash computation.