DORA and NIS2: What Software Continuity Evidence Looks Like

DORA and NIS2 have pushed software continuity out of the contract appendix and into the audit file. Financial firms, operators of essential services, and their suppliers are expected to show how critical systems keep running when a vendor is disrupted. A statement that “we have a business continuity plan” is no longer enough on its own.

SoftVault is used to make that evidence specific: essential materials are deposited, verified, and covered by an agreement that says when they can be released.

What auditors tend to ask

The questions are practical.

• Which suppliers could stop a critical service if they failed?
• Where is the source code, configuration, and related material if that happens?
• Who is allowed to receive it, and under what conditions?
• How do you know the deposit is complete and current?

Escrow answers those questions with a custodian, a deposit, and a release clause. It does not replace your own resilience work. It covers the gap you cannot close internally: software you depend on but do not own.

How a deposit becomes evidence

A folder of code is weak evidence. A verified deposit is stronger. SoftVault checks that materials are complete enough to be useful and can issue a software escrow certificate that clients, partners, and regulators can review. Immutable storage means the record is not quietly rewritten after the fact.

For teams in scope of DORA or NIS2, the useful step is to map critical suppliers to a deposit and a release condition, then keep that deposit aligned with what is actually in production. Continuity that only exists in a policy will not survive the question “show me the materials.”