DORA Observability: Building the Monitoring Infrastructure Regulators Want to See

When your supervisor asks "How do you know your critical systems are performing within acceptable parameters right now?" — the answer needs to be a dashboard, not a promise. DORA expects continuous monitoring with automated detection and alerting.

DORA Monitoring Requirements

• Performance monitoring — Response times, throughput, error rates for all critical ICT services
• Availability monitoring — Uptime tracking against defined SLAs for each critical function
• Security monitoring — Real-time threat detection, unauthorized access attempts, data exfiltration indicators
• Change monitoring — Configuration drift detection, unauthorized changes, deployment tracking
• Third-party monitoring — SLA compliance of ICT service providers, dependency health

Observability Stack for DORA

Metrics (Prometheus/Thanos/Mimir)

Collect metrics from every layer: infrastructure (CPU, memory, disk, network), application (request rate, error rate, duration — the RED method), business (transaction volumes, processing times, queue depths). Long-term storage (minimum 1 year) with cross-cluster federation.

Logs (Loki/Elasticsearch)

Centralized log aggregation with: structured logging standards enforced across all applications, security event correlation, immutable storage for compliance retention (5+ years for audit-relevant logs), automated parsing and enrichment.

Traces (Jaeger/Tempo)

Distributed tracing for complex financial transaction flows. Essential for: root cause analysis during incidents, latency analysis across service boundaries, dependency visualization, SLA measurement for end-to-end transactions.

Security Events (SIEM)

Security-specific observability: correlation of events across infrastructure, application, and network layers, automated threat detection rules (SIGMA), SOAR integration for automated response, regulatory reporting integration.

SLA Dashboards for Supervisors

Build dashboards that answer supervisor questions directly: Which critical functions are currently within SLA? What was the availability over the last quarter? How many incidents occurred, and what was the mean time to recover? Are third-party providers meeting their contractual SLAs?