01
The questionThe problem, as it is usually asked
The slow part of an incident is rarely the stop. It is knowing what the agent touched, who read it, and whether undoing it will break something else.
What people ask
How fast can we stop one agent without stopping the others?
What did it touch while it was running?
Who confirmed the restore, and against which checkpoint?
A stop answers the first, a blast map the second, and a confirmation recorded in the ledger the third. The restore never runs on its own.
02
RegulationThe rules and the business context
DORA, incident handling
Regulation (EU) 2022/2554AppliesSince 17 January 2025
Financial entities must detect, classify and respond to ICT incidents and keep records of them. A stop with its reason and a blast map give the response a recorded start and a defined scope.
Official text ↗Blast radius
Practice contextAppliesOngoing
The cost of an agent incident grows with what it touched and who consumed it. Mapping that first turns a restore from a guess into a plan.
Legal references are summarised and dated as of October 2026. They are given so you can see where the need comes from, not as legal advice. Read the official text, and ask counsel how it applies to you. Intramedial does not make any organisation compliant with any law.