Which DORA obligations does H33-74 evidence support?

H33-74 receipts support DORA's ICT risk-management framework, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk monitoring, and information sharing. Each control decision or outcome emits a receipt the competent authority can verify.

Is the primitive different for DORA than for other regulations?

No. H33-74 is the same 74-byte post-quantum primitive across every regulation. Only the crosswalk to the specific controls differs; the primitive itself is unchanged whether applied to DORA, SOX, or NIS2.

Does producing H33-74 evidence make my organization fully compliant with DORA?

No. H33-74 produces evidence that supports and maps to DORA requirements. Producing this evidence does not by itself make an organization fully compliant; compliance depends on the underlying controls actually operating and on the entity's broader DORA program.

How is an H33-74 receipt verified?

Each receipt is verified with an independent, open-source offline verifier. The competent authority or auditor verifies the receipt directly, without contacting H33 and without the financial entity's original systems being operational.

Does the evidence survive if systems, vendors, or chains change?

Yes. Each control's record outlives the system that produced it, the vendor that hosts it, and the chains it was anchored to. Post-quantum signatures address long-horizon cryptographic survival and chain-portable anchors address any single chain's deprecation.

H33-74 for DORA — Chain-Portable ICT Resilience Evidence

H33-74 for DORA

Related · tier-1 reading. For what a portable artifact actually is, see Portable Artifact.

This is H33-74 — the portable 74-byte post-quantum evidence primitive that produces and anchors operational proof — applied to DORA. The primitive is unchanged; only the application context differs, and the evidence it produces supports (does not by itself satisfy) the regulation. Digital Operational Resilience Act requires verifiable evidence of operational controls. H33-74 produces that evidence as a chain-portable post-quantum receipt that survives the systems and chains it was anchored to.

Digital Operational Resilience Act (European Union, financial entities) places obligations on organizations to demonstrate that operational controls were in place, that AI and automated decisions were governed, and that an audit trail exists for regulatory inquiry. Most existing audit-log architectures meet the letter of the requirement but produce evidence that is tied to the operator's current systems. If those systems change or fail, the evidence weakens.

H33-74 produces audit evidence that survives the system that produced it. The receipt is cryptographically verifiable independent of the operator. The PQ signatures survive the quantum transition. The chain anchors survive any single chain's deprecation. The audit horizon is institutional, not application-bound.

What DORA requires

DORA requires financial entities to demonstrate that ICT risk is managed, ICT-related incidents are reported, resilience testing is performed, and ICT third-party risk is monitored. The competent authority can request evidence of controls operating effectively across the full reporting period. DORA's reporting horizon (incidents, major changes, third-party arrangements) requires evidence that survives technology refresh cycles, vendor changes, and chain migrations.

Why H33-74 fits

DORA evidence must be reproducible to the competent authority on demand, often years after the events occurred. H33-74 receipts are cryptographically verifiable by the authority directly, without requiring the financial entity's original systems to be operational. The PQ signatures address long-horizon cryptographic survival; the chain-portable anchors address the long-horizon viability of any specific notarization chain. DORA's evidence requirements get longer-horizon protection without changing the entity's underlying ICT stack.

Control mapping

ICT risk management framework

Each risk assessment, mitigation decision, and residual-risk acceptance emits an H33-74 receipt. The framework's operation is independently verifiable by the competent authority.

ICT incident reporting

Incident detection, classification, containment decisions, and resolution emit receipts. The incident timeline is a chain-portable evidence sequence the authority can reconstruct.

Digital operational resilience testing

Threat-led penetration testing results, recovery exercise outcomes, and remediation decisions all emit receipts. Test evidence is cryptographically verifiable independent of the testing vendor's continued availability.

ICT third-party risk

Each third-party assessment, contractual control decision, and ongoing monitoring outcome emits a receipt. Third-party risk evidence survives changes in vendors and platforms.

Information sharing

Threat intelligence shared with peer entities and authorities can be anchored to H33-74 receipts for non-repudiation and timing assurance.

What this changes for the audit team

Each control's evidence is a cryptographic object the auditor verifies directly, not a log entry the auditor trusts because the operator says so.
The audit horizon extends beyond the operator's current systems, vendors, or chain choices.
Regulator inquiry years after a decision can be answered with the original PQ-signed receipt rather than reconstructed from operator memory.
Independent third-party verification works without the operator's infrastructure being available.

How H33-74 is integrated

For each control that produces a decision or outcome, the system emits an H33-74 receipt at the moment the decision is made.
Receipts are signed with three independent post-quantum signature families and contain the structured computation result.
Receipts are anchored on one or more chains as the audit policy requires (delayed or immediate, single-chain or multi-chain).
The audit team is given the receipt store and the open-source verifier. They verify independently.

The DORA audit trail becomes chain-portable evidence. Each control's record outlives the system that produced it, the vendor that hosts it, and the chains it was anchored to.

H33-74 is the same primitive across every regulation — only the crosswalk differs. Compare the sibling mappings for SOX and NIS2. Where ICT controls must be shown to stay true continuously, HATS records that ongoing control evidence on this same H33-74 substrate.

The chain-portable evidence model

Read the architectural concept underneath every H33-74 regulatory deployment.

Chain Portability Why Chain Migration Shouldn't Exist