{% extends "base.html" %} {% set active_page = "compliance" %} {% block title %}FaultRay - Compliance{% endblock %} {% block page_title %}Compliance Framework{% endblock %} {% block page_subtitle %}Regulatory compliance assessment and tracking{% endblock %} {% block top_actions %} Export Report {% endblock %} {% block content %}

DORA Compliance

{% set dora_score = 74 %}
{{ dora_score }}
Compliant

Control Summary

12
Passed
5
Partial
3
Failed

DORA Controls

{% set dora_controls = [ {"id": "DORA-ICT-01", "title": "ICT Risk Management Framework", "status": "PASS", "desc": "Risk management policies and procedures established"}, {"id": "DORA-ICT-02", "title": "ICT Incident Reporting", "status": "PASS", "desc": "Major incident classification and reporting mechanisms"}, {"id": "DORA-ICT-03", "title": "Digital Operational Resilience Testing", "status": "PASS", "desc": "Regular resilience testing program with FaultRay"}, {"id": "DORA-ICT-04", "title": "ICT Third-Party Risk", "status": "FAIL", "desc": "Third-party provider risk assessment incomplete"}, {"id": "DORA-ICT-05", "title": "Information Sharing", "status": "PARTIAL", "desc": "Threat intelligence sharing partially implemented"}, {"id": "DORA-ICT-06", "title": "Threat-Led Penetration Testing", "status": "PASS", "desc": "TLPT program aligned with TIBER-EU framework"}, {"id": "DORA-ICT-07", "title": "ICT Business Continuity", "status": "PARTIAL", "desc": "BCP exists but recovery testing needs improvement"}, {"id": "DORA-ICT-08", "title": "ICT Change Management", "status": "PASS", "desc": "Change management procedures with rollback capability"}, {"id": "DORA-ICT-09", "title": "Backup & Recovery", "status": "FAIL", "desc": "RPO/RTO targets not met for secondary systems"}, {"id": "DORA-ICT-10", "title": "Audit & Logging", "status": "PASS", "desc": "Comprehensive audit logging with tamper protection"} ] %} {% for c in dora_controls %} {% endfor %}
IDControlStatusDescription
{{ c.id }} {{ c.title }} {% if c.status == "PASS" %} PASS {% elif c.status == "PARTIAL" %} PARTIAL {% else %} FAIL {% endif %} {{ c.desc }}

SOC 2 Compliance

82
Compliant

Trust Service Criteria

18
Passed
3
Partial
1
Failed

SOC 2 Trust Services

CategoryControls PassedStatus
Security8/9Partial
Availability5/5PASS
Processing Integrity4/4PASS
Confidentiality3/3PASS
Privacy2/3Partial

ISO 27001 Compliance

71
In Progress

Annex A Summary

68
Implemented
18
In Progress
8
Not Started

ISO 27001:2022 implementation is in progress. 68 of 94 Annex A controls have been implemented. Key gaps exist in A.8 (Technology) and A.5 (Organizational) domains. Target certification date: Q3 2026.

PCI DSS v4.0

54
Non-Compliant

Requirements

6
Compliant
3
Partial
3
Non-Compliant

PCI DSS v4.0 assessment is ongoing. Critical gaps in Requirement 6 (Secure Systems), Requirement 10 (Logging/Monitoring), and Requirement 11 (Regular Testing). Remediation plan targets Q2 2026 for full compliance.

NIST CSF 2.0

81
Strong

Core Functions

6
Functions
19
Implemented
4
In Progress
FunctionMaturityStatus
Govern (GV)Tier 3Strong
Identify (ID)Tier 3Strong
Protect (PR)Tier 2Moderate
Detect (DE)Tier 3Strong
Respond (RS)Tier 3Strong
Recover (RC)Tier 2Moderate
{% endblock %}