roigen

DORA Register of Information generator — ITS 2024/2956 templates, validates, exports

v1.0.0
NixOS x86_64

Quick start

Install via jcli (recommended)

jcli install roigen

If you don't have jcli yet, install it first with curl -fsSL https://cli.johlem.net/tools/jcli/install.sh | bash.

Install directly

curl -fsSL https://cli.johlem.net/install.sh | bash -s -- roigen

Ed25519 signature verification is mandatory by default; set ALLOW_UNVERIFIED=1 to explicitly opt out (not recommended).

Run it

roigen --help                # subcommand catalogue + flags
roigen --full                # extended help across every subcommand
roigen --about               # machine-readable attribution (JSON)
roigen --version             # version string

What it does

roigen templates, validates, and exports the DORA Register of Information per ITS 2024/2956. Five sub-tables (RT.01.01 maintaining entity / RT.02.01 ICT third-party providers / RT.03.01 contractual arrangements / RT.04.01 critical functions / RT.05.01 sub-outsourcing). Validation enforces required fields, controlled vocabularies (entity_type / tpp_identifier_type / ict_service_type), AND referential integrity — every contract.tpp_id resolves to a known provider, every contract.function_id resolves to a known function, every subcontract.contract_id resolves to a known contract. Five subcommands: init (scaffold a starter file), add-provider (append a TPP block), validate (consistency checks), dryrun (ESA-style strict checks), export (xml/csv/json/jfind). jfind output emits one third-party-risk finding per contract with pre-filled DORA Art. 28/30/31 + NIS2 Art. 21(2)(d) controls so complymap and dossier consume it directly. Taxonomy vendored at data/roi_taxonomy.json. Offline-only. 7 unit + 13 integration tests green; zero compiler warnings.

Authorisation and warranty: use only in environments where you have explicit written authorisation. This tool is provided as-is with no warranty. Report vulnerabilities privately at security@johlem.net.

Compliance crosswalk

This table lists controls where roigen's output may form part of the evidence set presented to an assessor. It does not claim roigen alone satisfies any framework — every control still requires assessor judgment and typically evidence from other sources.

Schema: compliance-crosswalk/v1 · Machine-readable: tools/roigen/compliance.json

DORA — Digital Operational Resilience Act (Reg. 2022/2554)

RefNameHowCoverage
Art. 28 General principles — ICT third-party risk Register of Information is the machine-readable inventory of every ICT third-party provider. evidences
Art. 29 Preliminary assessment of ICT concentration risk RT.02.01 provider table + RT.05.01 sub-outsourcing chain feed the concentration-risk analysis. evidences
Art. 30 Key contractual provisions RT.03.01 contract table records the mandatory Art. 30 elements per relationship. evidences

ITS-2024-2956 — Implementing Technical Standard on Register of Information

RefNameHowCoverage
RT.01.01 Maintaining entity Table generated verbatim. evidences
RT.02.01 ICT third-party service providers Table generated verbatim. evidences
RT.03.01 Contractual arrangements Table generated verbatim. evidences
RT.04.01 Functions supported Table generated verbatim. evidences
RT.05.01 Sub-outsourcing chain Table generated verbatim. evidences

Release artefacts & provenance

Every signed release ships with checksum + signature sidecars plus a CycloneDX SBOM. Enterprise procurement can pin third-party components without unpacking the binary.