Entropy scoring & verification
DORA (Digital Operational Resilience Act)
Regulation (EU) 2022/2554, which sets ICT risk-management, incident-reporting, resilience-testing and third-party-risk requirements for EU financial entities — banks, insurers, investment firms, payment providers and similar — and has applied since 17 January 2025. ICT vendors to those firms are drawn in through the contractual requirements the firms must impose, and the most critical ones fall under direct EU oversight. It is a regulation to comply with rather than a certificate someone issues, so Entropy tracks a vendor’s DORA compliance attestation, and counts it toward the Governance score only when an admin has marked it as applicable to that vendor.