# DORA

Source: https://s3msecurity.com/compliance/dora/
Last updated: 2026-11-12

S3M supports the ICT risk-management articles of DORA with technical controls. ConnGuard NAC and APNZone identify every device down to the SIM, ConnGuard NAC and EndGuard isolate affected devices automatically, CityGate limits access to what policy allows, and SAMI keeps audit-ready records. The table maps Articles 8, 9, 10 and 17 to these products.

**Regulation (EU) 2022/2554, the Digital Operational Resilience Act.** Applies to: Banks, insurers, investment firms and other financial entities in the EU. Official text: https://eur-lex.europa.eu/eli/reg/2022/2554/oj

## How S3M supports it

| Article / control | What it asks | How S3M supports it | Products |
| --- | --- | --- | --- |
| Art. 8(1) | Identify, classify and document ICT-supported business functions and the ICT assets behind them. | ConnGuard NAC lists every device on the network, managed, IoT or BYOD, with its identity and type. | ConnGuard NAC |
| Art. 8(4) | Identify all ICT assets, including network and hardware assets at remote sites, and map the critical ones. | ConnGuard NAC and APNZone show devices across branches and cellular links, down to the SIM and the hardware fingerprint. | ConnGuard NAC, APNZone |
| Art. 9(4)(b) | Manage the network so that affected assets can be isolated automatically during an attack. | ConnGuard NAC isolates devices that fail posture checks automatically, and EndGuard isolates a compromised endpoint mid-session. | ConnGuard NAC, EndGuard |
| Art. 9(4)(c) | Limit physical or logical access to ICT assets to what is required. | ConnGuard NAC and CityGate give each user and device access only to the segments its policy allows. | ConnGuard NAC, CityGate |
| Art. 9(4)(d) | Use strong authentication mechanisms based on relevant standards. | ConnGuard NAC authenticates users and devices with 802.1X and RADIUS. S3M does not provide multi-factor authentication. | ConnGuard NAC |
| Art. 10(1) | Detect anomalous activities promptly. | APNZone detects unauthorized SIMs and a SIM moved to another device, and EndGuard flags devices whose posture changes during a session. | APNZone, EndGuard |
| Art. 17(2) | Record all ICT-related incidents and significant cyber threats. | SAMI keeps audit-ready records and answers questions about an incident from telemetry, with the source shown. | SAMI |

S3M supports these requirements with technical controls. This is not legal advice or a certification; confirm legal questions with your counsel.

Checked against the official text on 2026-11-12.

## Frequently asked questions

### Which DORA articles does S3M support?

Parts of Articles 8, 9, 10 and 17, as the table shows: asset identification, automatic isolation, access limits, authentication, detection and incident records. Backup, recovery and third-party risk need other tools.

### Can S3M isolate a device automatically, as Article 9(4)(b) describes?

Yes. ConnGuard NAC isolates devices that fail posture checks, and EndGuard isolates an endpoint that turns compromised during its session.

### Does S3M cover ATMs and branch devices?

Yes. ConnGuard NAC sees devices across branches, and APNZone binds each SIM to its device for ATMs and terminals on private APN.