Independent assurance that cyber and operational-resilience commitments are evidenced — not asserted — through the programme and after go-live.
The Digital Operational Resilience Act (and NIS2, widening scope across sectors) turns resilience from a policy statement into an evidenced obligation: ICT risk management, incident handling, resilience testing and third-party risk. Impact tolerances and recovery objectives are signed in documents — whether the controls actually hold, and keep holding, is rarely checked by an independent party against the evidence.
We evidence it, independently. One point-in-time view of whether the resilience commitments are met and sustained — computed from your own data, never self-reported.
Are the declared controls in place and operating — evidenced from your own control metrics, not asserted in a policy?
Does data integrity hold against baseline over time, after go-live — or is it quietly drifting?
Are the stated impact tolerances and recovery objectives backed by the recovery tier actually in place — and is it worth its cost?
The connected estate and off-system/third-party ICT dependencies mapped — the DORA third-party-risk surface made visible.
Where AI or automation acts in resilience-critical flows, is each within the authority it was granted?
Every verdict sealed, tamper-evident and verifiable offline — defensible to a regulator or the board.
Every assessment is computed from your own captured evidence, point-in-time — cited and sealed in a verifiable receipt (IVAR). We record what the evidence shows; we do not claim "live" or "continuous".
Is the programme designed to meet its resilience and control commitments?
Are control decisions, owners and conditions tracking to what was approved?
Resilience and control conditions evidenced at each gate; client and SI decide.
After go-live — is resilience being maintained, or has it drifted?
A consultant or SI positions the suite into the programme and delivers it. Independent assurance rides alongside — the standard and the evidence are ours; delivery and sign-off are the accountable parties'.
Find a partner →If this is one of several programmes, Keystone rolls it into one independent board view alongside the rest of the portfolio — the cockpit and the board assurance report, enterprise-run.
Explore Keystone →The demo is normally gated — request access and we'll walk you through it on representative data.