Log checklist for DORA and NIS2
Which events to record, with the exact action name. No form to fill in: print it or save it as a PDF.
Every row is an action the AuditRails catalogue accepts at ingest today. Use it as a control list against your current system, even if you are not a customer: if a row is not covered anywhere, that is a gap an inspection can find.
DORA, Regulation (EU) 2022/2554
Applicable since 17 January 2025 to financial entities and their ICT providers. In Italy supervision runs through Banca d'Italia, Consob and IVASS.
| Action | What it proves | |
|---|---|---|
| auth.login | Who entered the ICT systems and when. | |
| auth.failed | Failed access attempts, the basis for anomaly detection. | |
| access.granted | Access granted: to whom, over what, with which role. | |
| access.revoked | Access revoked, the half of the pair almost everyone forgets. | |
| config.changed | Configuration changes to ICT systems. | |
| incident.detected | The moment an ICT incident was detected, from which every deadline runs. | |
| incident.notified | Notification of the incident to the competent authority. | |
| incident.resolved | Incident closed and how it was resolved. | |
| backup.completed | Backups run, supporting operational continuity. | |
| vulnerability.scan | Resilience testing and vulnerability scans. | |
| training.completed | Training completed by staff. | |
| data.exported | Data extractions, including those to third parties. |
NIS2 in Italy, D.Lgs. 138/2024
Art. 25 requires three filings to CSIRT Italia on the same incident: early warning within 24 hours, full notification within 72, final report within a month. The three highlighted rows below are what make those deadlines provable.
| Action | What it proves | |
|---|---|---|
| auth.login | Successful authentications on in-scope systems. | |
| auth.failed | Failed attempts, for anomaly detection. | |
| auth.mfa | Multi-factor authentication events. | |
| access.granted | Access granted to critical systems or data. | |
| access.revoked | Access revoked. | |
| incident.detected | When you became aware of the incident. This is the moment the 24 and 72 hours run from. | |
| incident.early_warning | Early warning to CSIRT Italia within 24 hours. Requires incident_id, which ties the three filings to one incident. | |
| incident.notified | Full notification within 72 hours. | |
| incident.final_report | Final report within one month, or an interim report while the incident is still open. | |
| incident.resolved | Incident closed. | |
| backup.completed | Backups run, supporting continuity. | |
| training.completed | Training of staff and of the management body. |
What a checklist does not solve
Logging the right event is half the work. The other half is that the record survives someone disputing it: if the same administrators an inspection is meant to hold accountable can edit the dates, the list above proves nothing. That is why AuditRails hash-chains every event with SHA-256 onto WORM storage, and why the verifier is open source so your auditor can run it without going through us.
The actions listed are those the AuditRails catalogue accepts today. This document is not legal advice: whether DORA and D.Lgs. 138/2024 apply to your organisation has to be assessed separately.