DORA
DORA. Run with --compliance=Dora to keep only the findings mapped to it, with their control ids in a ControlId column.
Controls covered: Art. 9, 10, 11, 12
Official text: Regulation (EU) 2022/2554.
| Gravity | ControlId | Code | Id | Description | Context | SubContext |
|---|---|---|---|---|---|---|
| Critical | Art.9 | CC0004 | access/users/root@pam | root@pam has no TFA configured — full access protected only by password | Cluster | Access |
| Critical | Art.11, Art.12 | CG0002 | nodes/pve02/qemu/203 | Disk 'scsi0' disabled for backup | Qemu | Backup |
| Warning | Art.11 | WS0009 | nodes/pve01/storage/pbs01 | Storage usage 80% - 2.58 TB of 3.22 TB | Storage | Usage |
| Warning | Art.11, Art.12 | WG0017 | nodes/pve02/qemu/999 | vzdump backup not configured | Qemu | Backup |
| Info | Art.11 | IC0002 | cluster | No HA resources configured — VMs will not automatically restart on node failure | Cluster | HA |
| Ok | Art.11, Art.12 | WC0001 | cluster/backup | 3 backup job(s) configured at cluster level | Cluster | Backup |
| Ok | Art.11, Art.12 | WG0017 | nodes/pve01/qemu/100 | Guest is covered by at least one enabled backup job | Qemu | Backup |
| Ok | Art.11, Art.12 | WG0017 | nodes/pve01/qemu/101 | Guest is covered by at least one enabled backup job | Qemu | Backup |
One row per object: a check failing — or passing — on ten VMs gives ten rows, all the controls of a finding in the same row.
Ok rows come from --full, or IncludeOkResult: true in the settings file.Controls
Section titled “Controls”In the tables below, Where it appears names the checks that carry the control. (declared) marks a control of the standard that is relevant to a virtualisation cluster but that no check can verify from the Proxmox VE API — typically a process, a plan or a test. It is listed so the coverage is explicit: evidence for it has to come from outside cv4pve-diag.
| Article | Title | Where it appears |
|---|---|---|
| Art. 9 | ICT security policies | TFA |
| Art. 10 | Detection of anomalous activities | Cluster log, task failures, metric server |
| Art. 11 | Response and recovery (ICT business continuity) | HA, replication, single-node, storage availability, replication errors, backup |
| Art. 12 | Backup policies, restoration and recovery procedures | Backup, storage backup config, disk cache integrity |
How the mapping works, and its limits: Compliance overview.