Skanse - GRC Platform for Risk, Controls and DORA Incident Reporting

Dashboard, risk register, risk detail with its assessment panel, ICT incident log and incident detail with the DORA classification form and incident clock.

Initial notification at the earlier of 4 hours after classification and 24 hours after awareness, the intermediate report 72 hours later and the final report one month after that, with a separate GDPR 72-hour clock for Datatilsynet.

Inherent, residual and target scores on one matrix, with the highest of four impact dimensions driving impact. Each risk is checked against the residual limit for its category, across 8 appetite categories.

3 legal entities, 17 staff across the three lines, 18 controls mapped to DORA, ISO 27001 and internal policies, 12 KRIs with 12 months of values, 12 issues and 12 ICT incidents.

Forty Workbooks, No Single Picture

Each entity and department kept its own register or matrix, so scores, owners and control results did not line up. Numbers in the board pack did not always match between slides, because each one came from a different file.

DORA Reporting Runs in Hours

A major ICT incident is generally reported with an initial notification within 4 hours of classification and no later than 24 hours after becoming aware of it. Classification depends on clients, transactions, downtime, spread, data losses, economic and reputational impact, and has to be right the first time.

Coverage Nobody Could Prove

Controls had to map to DORA articles, ISO/IEC 27001:2022 Annex A and internal policies at once. With testing evidence sent by email, there was no way to show which requirements had a tested, effective control behind them.

Three Lines, Separate Permissions

Risk and control owners, the risk and compliance functions and internal audit each do different things. Testers cannot test controls they own, closing an internal audit finding needs internal audit's validation, and every score change has to be traceable.