DORA and SBOM packages for clients asked for supplier evidence
Purchased-service workspaces for DORA vendor evidence and SBOM evidence, at Essentials, Managed and Enterprise levels, plus a combined DORA + SBOM Enterprise Suite. The Business Passport tier each needs is included in the price.
In an MSP client estate
Why DORA and SBOM packages matters for a managed estate
Who it is for
The MSP problem it addresses
The client problem it addresses
When to attach it to a client
What the MSP receives
- A workspace for the client's DORA or SBOM evidence.
What the client receives
- Vendor-side evidence documentation, with the included Business Passport tier.
How it fits the recurring Machine Trust service
Options, prices and state
Each option, as TrustOps lists it
Bought in TrustOps; each package and cadence is a separate option with its own state, shown below. Prices and what can be bought today come from TrustOps, which owns every purchase, entitlement and renewal.
DORA and SBOM packages
DORA Essentials
DORA Managed
DORA Enterprise
SBOM Essentials
SBOM Managed
SBOM Enterprise
Monthly£2,499 per monthPaid · Temporarily unavailableView detailsPrice published by TrustOps. Online purchase is not open for this option in the snapshot this page was built from; TrustOps shows the current state.DORA + SBOM Enterprise Suite
States and prices from the TrustOps catalogue snapshot of 2026-10-14; TrustOps shows the current state. Buying a capability changes what you can operate. It never changes what the public record proves, and no paid tier is a verification outcome.
What you get
In TrustOps' own words
DORA Essentials
Foundational DORA vendor credentialing. Cyber resilience, software supply chain, risk policy, and identity continuity — verifiable by procurement and insurers via resolver.
DORA Managed
DORA Managed: the purchased-service workspace for DORA evidence, with the Business Passport tier included. Included now: Quarterly posture review cadence; Risk and policy register; Incident records; Resilience test records; Contractual arrangement records; Review reminders by email. Not live yet: Incident notification readiness documentation; Contractual reliance receipts; Resilience test records (Articles 24–26); Core export packets (procurement, insurer, summary); Managed onboarding and dedicated account support.
DORA Enterprise
DORA Enterprise: the purchased-service workspace for DORA evidence, with the Business Passport tier included. Included now: Register-template-shaped export for regulator and audit review; TLPT-adjacent posture documentation; Enterprise API access. Not live yet: Multi-entity / group structure; Enterprise SLA and dedicated technical contact; Custom contract terms.
SBOM Essentials
Foundational SBOM liability credentialing. Software supply chain, product passports, cyber resilience, and IoT device identity — verifiable via ECZ-ID resolver.
SBOM Managed
SBOM Managed: the purchased-service workspace for SBOM evidence, with the Business Passport tier included. Included now: SBOM ingestion analytics overlay; Quarterly SBOM review cadence; Review reminders by email; Continuous monitoring alerts. Not live yet: Managed onboarding by the ECZ-ID solution team; Vulnerability and VEX records in Core; Core publication packets (liability, procurement, insurer, summary).
SBOM Enterprise
Enterprise SBOM structural posture. Multi-product/multi-entity SBOM credentialing with supply chain event attestation, custodial receipt packages, and enterprise API access.
DORA + SBOM Enterprise Suite
DORA + SBOM Enterprise Suite: the purchased-service workspace for DORA and SBOM evidence, with the Business Passport tier included. Included now: Register-template-shaped export for regulator and audit review; TLPT-adjacent posture documentation; Enterprise API access; Enterprise API access; Combined evidence package for auditors and insurers; Single-pane authority dashboard. Not live yet: Multi-entity / group structure; Enterprise SLA and dedicated technical contact; Custom contract terms; Multi-product / multi-entity support; Supply chain custody event attestation; Custodial receipt packages for regulators; Enterprise SLA and technical contact; Custom contract terms; Unified resolver profile across both postures; Dedicated enterprise success manager; Suite-level commercial terms.
How it works
In plain English
- 1Choose DORA, SBOM or the combined suite at the level the client needs.
- 2The included Business Passport tier and workspace are set up in TrustOps.
- 3Evidence is prepared and shared; workspace readiness is stated feature by feature.
Inputs
- The client's evidence for its DORA or SBOM scope.
Outputs and evidence
- A credentialing posture and evidence documentation in the workspace.
With your existing stack
Boundaries
What it does not do
- Credentialing, not certification: an evidence status is never a regulator's approval.
- It does not make a client compliant with DORA, the CRA or any other law.
TrustOps terms for DORA Essentials
- Credentialing, not certification.
- An evidence status is never a regulator's approval.
- The Business Passport tier it needs is included in the price.
- Workspace readiness is stated feature by feature.
What buying it never changes
- the ECZ-ID of any Passport
- any regulatory status (evidence is prepared and shared, never an approval or a compliance determination)
- any child Passport assurance
Proof and integration
Resolver and Developer Gateway
Resolver relationship
Developer Gateway route
In the MSP journey
What comes before and after
Usually comes before
Usually comes after
Related
Questions
DORA and SBOM packages: questions MSPs ask
Does a DORA package make my client DORA-compliant?
Can every package be bought in every cadence?
Next step