PACK-01Profile JSON
Operational object.
The machine-readable profile with public identifiers and strict versioning.
Catalogue / Inventory / Maturity states
Profiles are public objects, not product claims.
The catalogue shows what can actually be inspected.
DORA is the worked profile. Other entries show intended catalogue direction and should not be treated as stable unless their evidence state says so.
01 / Status matrix
One glance should show what is ready.
The matrix is deliberately blunt. It prevents the catalogue from appearing more mature than it is.
| Profile | Maturity | Source-bound | Mapper workpaper | Verifier | Use today |
|---|---|---|---|---|---|
| DORA major ICT incident initial notification | Verifier-ready worked example | Yes | Experimental public workpaper | Local hashing | Inspect, test, challenge |
| EUDR Due Diligence Statement | Draft direction | Partial | Planned | No | Do not rely |
| NIS2 Article 23 incident report | Draft direction | Partial | Planned | No | Do not rely |
| GDPR Article 33 breach notification | Candidate | No | Planned | No | Research only |
| CSRD sustainability statement evidence pack | Candidate | No | Planned | No | Research only |
02 / Profile passport
Each profile needs an identity card.
The passport is the compact truth object: ID, source state, mapper state, verifier state and claim boundary.
Profile IDeu.dora.ict_incident.major.initial.v1
Source jurisdictionEuropean Union
Source artefactsOfficial files pinned by SHA-256
MapperPublic workpaper, experimental
VerifierLocal file hashing available
Legal claimNo compliance determination
03 / Profile packs
The future catalogue should ship evidence packs.
A profile pack is not just JSON. It is the full review surface.
PACK-02Source bundle
Hashable basis.
Official artefacts and descriptor files used by the profile.
PACK-03Mapper report
Human judgement visible.
Fragments, mapping choices and review-required decisions.
PACK-04Test vectors
Implementation support.
Examples to help implementers test their integration without overclaiming legal validity.
04 / Boundary
The catalogue is not a certification register.
It is an inventory of inspectable public-rule machine-profile work.
This layer can show
- official source artefacts named and hashed
- field provenance, mapper notes and reproducibility
- schema divergence against a public reference profile
- where interpretation entered the machine profile
This layer cannot show
- legal approval or supervisory acceptance
- that a filing, firm or vendor is compliant
- that a mapping is legally complete without review
- that pinned sources are automatically the latest legal state