Critical or Important Functions — DORA's central pillar
The only BCMS covering every DORA obligation tied to CIFs: registry, AI justifications, ICT third-party mappings, Register of Information, concentration analysis, subcontracting chain, exit strategies, TLPT scope.
6 CIF pillars
One module covering the entire CIF lifecycle under DORA.
CIF registry compliant with Art. 3(22)
Function identification per the 4 criteria (financial performance, continuity, authorisation, other obligations). Auditable factual justification. Per-CIF RTO/RPO/MTPD.
AI justification in 15 seconds
ResiPlan AI drafts the criticality justification from name + business area + checked criteria. Audit-ready tone, explicit DORA references. Saves 2h per CIF.
ICT third-party mappings (Art. 28)
CIF ↔ ICT provider mapping with dependency level (sole/primary-backup/active-active/supporting), country, cloud service type, subcontracting chain (Art. 29), exit strategy (Art. 28(7)(j)).
Concentration analysis (Art. 29)
Top providers by CIFs covered, single-source detection, geographic concentration (EU vs non-EU, Schrems II). Overall risk level (low/medium/high/critical) + recommendations.
Register of Information (Art. 31)
Formal registry with LEI, CIF count, contracts, providers, concentration metrics. Ready for ESA submission (EBA/ESMA/EIOPA) and national authorities (ACPR, AMF, BaFin…).
TLPT scope (Art. 26-27)
CIFs flagged 'inTlptScope' are automatically included in the existing TLPT module for threat-led penetration tests every 3 years.
DORA articles covered
Against competitors
| Feature | ResiPlan | Fusion | Archer | Riskonnect | ServiceNow IRM |
|---|---|---|---|---|---|
| CIF registry with Art. 3(22) criteria | — | — | — | — | |
| AI-generated justification | — | — | — | — | |
| Register of Information (Art. 31) | — | — | — | — | |
| Concentration + geo analysis (Art. 29) | — | — | — | — | |
| Subcontracting chain tracked | — | — | — | — | |
| Native TLPT integration | — | — | — | — |
GRC competitors all have DORA marketing modules — none natively covers the full CIF taxonomy (registry + ICT mappings + ROI Art. 31 + concentration Art. 29 + subcontracting + TLPT). ResiPlan is the only one delivering the complete CIF lifecycle, hosted in France.
Your DORA Register of Information ready in 1 week
Free 14-day trial. Identify CIFs, map ICT third-parties, generate the ROI, analyze concentration. All in one session.