Streamlining DORA & Cybersecurity Reporting for 500+ Institutions

The Challenge

Under a newly established four-year digitalisation framework contract, the AFM faced a dual crisis. First, their existing AFM Portaal was shipped with limited usability testing and was not scaling correctly, resulting in a fragmented ecosystem of \~60 statutory forms with high error rates. Concurrently, they faced a massive regulatory challenge: implementing the EU’s Digital Operational Resilience Act (DORA) for cybersecurity reporting. The AFM possessed no digital infrastructure to intake or triage these critical reports from the thousands of financial institutions they supervise.

The Approach

To rescue the AFM Portaal, I secured R&D resources for dedicated user testing—an unusual step for a highly risk-averse government organization. I established an empirical baseline using System Usability Scale (SUS) tracking and introduced a custom severity framework (Criticality × Impact × Frequency) to dictate the product roadmap.

For the time-sensitive DORA system, I prioritized "familiarity over novelty." I utilized radically simple progressive disclosure for the external "DORA app" and mirrored existing internal workflows for AFM supervisors. This ensured that neither external institutions nor internal regulators would have to learn complex new software paradigms during active cyber threat and ICT-incident reporting.

The Outcome

We successfully shipped the Netherlands' first DORA reporting system (the "DORA app") in November 2024, safely beating the strict EU enforcement deadline of January 17, 2025. The unified Portaal 2.0 consolidated a fragmented ecosystem of sub-portals, significantly dropped user error rates, and successfully solidified Netcompany's presence in the Dutch financial sector. The platform now serves as the central, mandatory cyber-threat reporting hub for the entire AFM-supervised market, establishing a standardized UX governance model for the remainder of the 4-year framework.

Lessons Learned

Data is the ultimate alignment tool for risk-averse executives; empirical frameworks completely stop subjective design arguments. Furthermore, when designing for extreme situations (like cyber crisis reporting), cognitive ease and system familiarity must always take precedence over innovative or trendy UI paradigms.