Technical Architecture Guide · EU Regulation
DORA & NIS2 Compliance Logging Blueprint
A practical reference architecture for engineering and compliance leads establishing immutable audit logging, third-party ICT dependency tracking, and fast incident classification across AWS, Azure, and Google Cloud.
1. DORA Article 10: ICT Systems, Protocols & Tools
Under DORA Article 10, financial entities must deploy automated mechanisms to record all ICT activities, including anomalous network connections, privilege escalations, and system changes.
✓
Centralized Cloud Control Plane Telemetry:
AWS CloudTrail multi-region trails, Azure Activity Logs, and GCP Audit Logs must be forwarded to a centralized security boundary with independent administrative access.
✓
Identity & Authentication Events:
All Okta / Microsoft Entra ID sign-in events, conditional access failures, and privilege role activations (PIM) must be captured in real time.
✓
Container Runtime & Kubernetes Auditing:
EKS/AKS API server logs and container execution anomalies captured via agentless posture tooling (Wiz / Tenable).
2. DORA Article 11: Immutable Retention & Integrity
Audit records must be protected from intentional tampering, accidental deletion, and unauthorized administrative alterations.
✓
WORM Storage Enforcement:
Enforce AWS S3 Object Lock in Compliance Mode or Azure Immutable Blob storage with strict retention timers.
✓
Cryptographic Log Hash Validation:
Enable CloudTrail log file validation to ensure SHA-256 digest integrity across multi-year archives.
✓
Tiered FinOps Retention Strategy:
Maintain 90-180 days in hot SIEM (Google SecOps / Chronicle) and lifecycle older records to low-cost cold storage (S3 Glacier Instant Retrieval) for the remaining 5+ years.
3. DORA Article 19: Incident Classification & 24-Hour Notification
Entities must be capable of classifying major ICT incidents based on number of clients affected, data loss materiality, and duration of service disruption.
✓
Automated SOAR Severity Triage:
Pre-configured correlation playbooks that calculate impact thresholds automatically when key database or API telemetry fires an alert.
✓
Standardized Reporting Runbooks:
Drafted initial incident templates mapped directly to European Supervisory Authority (ESA) reporting guidelines.