DORA ICT Resilience

1. Financial Sector Resilience

As AI becomes deeply integrated into algorithmic trading, risk modeling, and fraud detection, financial institutions face strict regulations under the Digital Operational Resilience Act (DORA). Hyperscaler outages are no longer acceptable risks. AGICY is engineered for extreme availability as a design target.

DORA (Regulation (EU) 2022/2554) entered into application on 17 January 2025. It applies to virtually all regulated financial entities and their critical ICT third-party service providers. When operational, AGICY intends to support financial institutions as an ICT third-party service provider within that framework.

2. Redundant Energy & Network Topology

Located at the Vasilikos Energy Center (pre-construction), AGICY is designing a proprietary micro-grid with direct access to Cyprus's primary energy infrastructure. The design target is a 99.999% uptime SLA, intended to support DORA's ICT third-party risk management expectations.

2.1 Redundancy Architecture

• Power: Dual gas turbine feeds + solar array + diesel backup (N+2 redundancy). No single point of failure in power delivery.
• Cooling: Ambient air cooling with redundant fan arrays. No water dependency means no drought-related downtime risk.
• Network: Dual submarine cable feeds (TEFKROS, ARSINOE) with automatic failover. Latency to Frankfurt: <18ms.
• Compute: Tenstorrent Galaxy fleet with hot-spare allocation (50 spare servers for 1,801 production units).

3. ICT Risk Management Framework (Article 6)

AGICY's planned ICT risk management framework includes:

• Comprehensive identification of all ICT-supported business functions, roles, and assets.
• Continuous monitoring and control of ICT systems security and functioning.
• Mechanisms for the prompt detection of anomalous activities.
• Dedicated and comprehensive business continuity policy.
• Learning and evolving mechanisms — incorporating lessons from incidents and TLPT exercises.
• Communication plans for responsible disclosure and crisis coordination.

4. ICT-Related Incident Reporting (Article 19)

AGICY intends to support financial-sector clients with automated incident classification and reporting infrastructure:

• Initial notification: Within 4 hours of classifying a major ICT-related incident.
• Intermediate report: Within 72 hours, with updates on impact assessment and recovery progress.
• Final report: Within 1 month, including root cause analysis and remediation measures.

A planned Security Operations Centre is designed to generate DORA-formatted incident reports so financial clients can forward them to their national competent authority.

5. Digital Operational Resilience Testing (Article 26)

AGICY plans the following testing programme:

• Quarterly: Vulnerability assessments and network security scans.
• Semi-annually: Open-source code reviews and software composition analysis.
• Annually: Full penetration testing by independent third-party providers.
• Every 3 years: Threat-led penetration testing (TLPT) in accordance with TIBER-EU framework.

6. Third-Party Risk Management (Article 28)

As a planned critical ICT third-party service provider, AGICY intends to provide financial clients with:

• Full contractual provisions as specified in Article 30 — including SLAs, data localisation guarantees, audit rights, and exit strategies.
• Planned SOC 2 Type II attestation reports covering Trust Service Criteria — a roadmap target, not currently held.
• Right to audit — AGICY plans to grant financial clients and their regulators the right to conduct on-site inspections with 30 days' notice.
• Exit strategy — documented transition plan ensuring orderly migration of workloads within 90 days, with no data lock-in.

7. Information Sharing (Article 45)

AGICY plans voluntary cyber threat intelligence sharing arrangements with financial sector ISACs (Information Sharing and Analysis Centres) across the EU, providing anonymised threat data from the planned Security Operations Centre to strengthen the collective resilience of the European financial ecosystem.