Sep 11, 2026
the day makers of connected products sold in the EU began owing a 24-hour early warning for actively exploited vulnerabilities. Fines reach €15 million or 2.5% of worldwide turnover.
Jones Day, July 2026Regulators, auditors, and customers no longer accept a policy as proof. DOR gives you a record of what your systems received, checked, and changed that no one can edit, so when someone asks what happened, you can show them.
This is already happening.
In 2025 and 2026, reporting clocks shortened to hours, and claims of compliance that could not be backed up started costing money.
72 hours
to report a covered cyber incident to CISA, and 24 hours to report a ransom payment, under the federal rule sent to the White House for final review on October 1, 2026. The proposed version reached an estimated 300,000 organizations.
Paubox, October 2026$507,144
paid by a defense contractor in June 2026 to settle claims that it billed the Navy while missing the security controls it said it had in place.
Mayer Brown, June 2026Jul 13, 2026
the day the Pentagon suspended CMMC Phase 2. Self-assessments and annual affirmations of compliance stayed in force, checked through select government-led assessments.
WilmerHale, July 2026Nov 1, 2025
the day New York began requiring regulated financial firms to use multi-factor authentication for every user on every information system and keep a written asset inventory.
Hogan Lovells, October 20251 day
after deciding a cyberattack was material, a public healthcare company disclosed it to investors on September 23, 2026. The attackers had impersonated staff and spoofed the company's own phone number.
SaltyCloud InfoSec GRC Brief, October 2026Every control, report, and record, proven.
Compliance comes down to showing what happened, when, and who approved it. DOR proves it at the moment it happens, not months later at audit time.
Incident ReportingThe clocks that start when something goes wrong, and the facts you report against them.Audit EvidenceLogs, control results, and the proof auditors and assessors ask for.Access and ApprovalsWho signed in, who approved what, and why.Software and SuppliersUpdates, components, and the attestations vendors hand you.Records and RetentionWhat you keep, what you release, and what you are required to hold.
Incident Reporting
The clocks that start when something goes wrong, and the facts you report against them.
R-01
Knowing what happened, fast
Reporting clocks now run in hours. DOR's record shows what your systems received and changed, and when, so the first report is built on facts.
R-02
A timeline that holds up
Attackers alter logs and clocks to blur what happened. DOR keeps the true order of events, so the timeline you report is the one that happened.
R-03
Impostors in the incident
Attackers impersonate staff and spoof phone numbers to get in. DOR confirms who sent a request before anyone acts on it.
Audit Evidence
Logs, control results, and the proof auditors and assessors ask for.
E-01
Logs no one can edit
An edited or deleted log turns an audit into a dispute. DOR's records cannot be changed after the fact, including by administrators.
E-02
Control results, not screenshots
Screenshots and spreadsheets show a control at one moment. DOR records each control result as it happens, ready for an assessor to verify.
E-03
Claims you can back up
Saying a control is in place when it is not now brings penalties. DOR's record shows what was actually running, so every claim of compliance has proof behind it.
Access and Approvals
Who signed in, who approved what, and why.
A-01
Every user, every system
Rules now require strong sign-in for every user on every system. DOR confirms the person and the device behind each sign-in.
A-02
Approvals with a reason
Sensitive changes need an approver and a reason. DOR requires both and records them where no one can edit them.
Software and Suppliers
Updates, components, and the attestations vendors hand you.
S-01
Updates that match what was approved
Software updates arrive from many vendors. DOR proves each one came from its maker and matches what was approved before it installs.
S-02
Vendor attestations
Vendors hand over security attestations and component lists. DOR checks them against what is actually running.
Records and Retention
What you keep, what you release, and what you are required to hold.
D-01
Records kept as they were
Records must stay exactly as they were made for years. DOR proves a record has not changed since it was created.
D-02
Releases, holds, and destruction
Records are released, held, and destroyed on schedules set by law. DOR requires a recorded reason for each and respects legal holds.
D-03
The rules you answer to
SEC disclosure rules, the federal incident reporting rule, CMMC, New York's cybersecurity rules, and EU law all ask the same question: can you prove it? DOR produces that record.
How DOR works with you.
Nothing to rip out. No dependence on a link to the outside. Every deployment starts with your controls as they run today.
Map the obligations
DOR maps the rules you answer to against the systems and records each one depends on.
Build to it
Every deployment is built to your systems, your auditors, and your reporting obligations.
Deploy on what you run
DOR runs as software on the systems you already operate, fully offline. Where a system has nothing suitable, DOR provides a compact host built for it.
Hand over the evidence
You get a record of what was checked, what was held, and why, ready for an auditor or regulator. It cannot be edited.
Inside every deployment
- Verification where it arrives
- Requests, updates, sign-ins, and records are proven authentic as they arrive.
- A hold, not just an alarm
- Anything that fails is held or flagged by rules you set, and released only by an authorized person with a recorded reason.
- A record that stands
- What was checked, held, and released, kept in a record no one can edit.
Questions compliance leaders ask.
Straight answers to what compliance, risk, audit, and security leaders ask first.
Does DOR make us compliant?
No tool can do that on its own. DOR gives you proof that controls ran and records are unchanged, so the compliance you build can be shown, not just stated.
Does DOR replace our compliance platform?
No. Compliance platforms track policies, tasks, and audits. DOR proves the evidence they collect is authentic and unchanged.
Will auditors and assessors accept DOR's record?
Anyone with a record and its proof can verify it on their own equipment and get the same answer, without relying on you or on DOR. What each auditor or regulator accepts is their decision.
Does DOR need a cloud connection?
No. DOR runs fully offline and depends on no outside service to verify anything.
Where does our data go?
It stays where it lives, under your control. DOR does not need regulated data to leave your systems to verify anything.
Do we have to replace our systems?
Usually not. DOR runs as software on the systems you already operate, and provides a compact host when a system has nothing suitable.
How does DOR help with SEC, CIRCIA, CMMC, New York, and EU rules?
Each asks organizations to show what happened to their systems and records, and when. DOR produces a verifiable record that cannot be edited. Public companies disclose material incidents within 4 business days. The federal incident reporting rule, sent for final review on October 1, 2026, sets 72 hours for incidents and 24 hours for ransom payments. CMMC self-assessments and annual affirmations remain in force. New York requires multi-factor authentication for every user. Since September 11, 2026, the EU Cyber Resilience Act requires a 24-hour early warning for actively exploited vulnerabilities.
Is DOR only for large organizations?
No. Every deployment is built to the organization in front of it, from a small defense supplier to a global financial firm.
What does an engagement with DOR look like?
DOR maps your obligations, builds to your systems and auditors, deploys on what you already run, and hands you the evidence. It starts with a briefing.
Reference
The Compliance Reference.
The full list behind this page: how logs, approvals, reports, and records get altered or faked, in plain language, with what DOR does about each one.
Compliance
Start with a briefing.
Bring your next audit, your reporting obligations, and the finding that keeps coming back, or just the question your board keeps asking. DOR will show you exactly where it fits.