ICT risk management
A documented framework you use to identify IT risks, protect systems and resolve disruptions. It includes access control, backup with restore, and plans for the failure of important systems.
For banks and financial service providers
Implementing DORA in ITResilience you can prove
The Digital Operational Resilience Act has applied to financial entities across the EU since 17 January 2025. It requires banks, insurers and other financial service providers to manage IT risks, report incidents quickly and keep their service providers under control. We translate these requirements into access rights, processes and evidence your IT can work with every day.
Since when DORA applies, and to whom
DORA is an EU regulation (2022/2554) and therefore applies directly, without a German law having to implement it first. Since 17 January 2025, financial entities in all sectors have had to apply it, including credit institutions, payment and e-money institutions, investment firms, insurers and investment management companies. For certain financial services institutions, DORA only applies from 1 January 2027 under the German Banking Act (KWG).
IT service providers feel the effects of DORA too, because financial entities have to adapt their contracts with them to the regulation. If you work for a bank or an insurer, you will therefore receive new contract clauses, audit rights and requirements for exit plans.
The core areas of DORA
Reporting ICT incidents
Incidents are classified according to fixed criteria. A major incident must be reported to BaFin no later than four hours after classification and no later than 24 hours after detection, followed by an intermediate and a final report.
Resilience testing
Systems that support critical or important functions are tested at least once a year. Selected institutions must also carry out threat-led penetration tests every three years.
Risk from IT service providers
All contracts with IT service providers are recorded in a register of information that is reported to the supervisory authority. For critical services, you need minimum contract content and an exit strategy.
Information sharing
Financial entities may share information on cyber threats with each other. Taking part in such arrangements is voluntary, but must be notified to the supervisory authority.
Management responsibility
The management body is responsible for ICT risk management. It sets and approves the framework and must keep its knowledge of IT risks up to date.
What DORA means for everyday IT
Many duties only become auditable in the technology. An audit typically checks these points:
- An access rights concept based on the principle that everyone only gets what they need for their job, with regular recertification
- Strong authentication and separate accounts for privileged access
- A defined joiner and leaver process so that rights are granted and revoked on time
- Backups kept separate from production systems, with a documented restore test
- Logging of security-relevant events and managed change and patch management
- A process for classifying incidents so that the four-hour deadline can be met at night and at weekends too
- A complete register of information for your IT contracts and exit plans for critical service providers
- Annual testing of the systems that support critical or important functions
DORA and the former BAIT
BaFin has largely replaced its circulars on IT requirements with DORA. VAIT, KAIT and ZAIT were repealed at the end of 16 January 2025. Institutions that have applied DORA since 17 January 2025 are excluded from the scope of the BAIT, and the BAIT will be repealed in full at the end of 31 December 2026.
Much of the content is familiar, as banks already knew access rights management, emergency planning and outsourcing management from the BAIT. DORA goes further on management responsibility, incident reporting and the management of service providers. BaFin has published implementation guidance on this, which we follow in our projects.
How we work with you
- 01
Current state review
We compare your IT practice with the DORA requirements and take into account what is already in place from the BAIT.
- 02
Action plan
You receive a list prioritised by risk, with effort estimates, agreed with compliance and internal audit.
- 03
Implementation
We implement access rights, recertification, the incident process and service provider management, working together with your existing service providers.
- 04
Evidence and support
The documentation is created as we work. After completion, we support your operations closely until the new processes are running smoothly.
Experience in banking
Banking sector · 250 users
Design and introduction of a new ITSM solution in close cooperation with the bank. We supported the project from implementation through go-live to post-launch support.
Result: Twelve months from project start to go-live, followed by a phase in which we supported operations closely.
Updated:
FAQ
Frequently asked questions
Since when has DORA applied?
DORA has applied to financial entities in the EU since 17 January 2025. For certain financial services institutions in Germany, the regulation applies from 1 January 2027 under the German Banking Act (KWG).
What does DORA require of IT?
DORA requires documented ICT risk management, reporting of major incidents, regular testing and management of IT service providers. In practice, this mainly concerns access rights, backup, logging and contracts.
Do the BAIT still apply?
They no longer apply to institutions that already apply DORA. BaFin will repeal the BAIT in full at the end of 31 December 2026. VAIT, KAIT and ZAIT were already repealed in January 2025.
Does NIS2 apply alongside DORA?
For financial entities that apply DORA, the BSI Act exempts them from most NIS2 duties. DORA is considered the more specific rule here.
How quickly must an ICT incident be reported?
A major incident must be reported to BaFin no later than four hours after its classification, but no later than 24 hours after detection. That is why classification must be prepared as a fixed process.
Do you advise on how to interpret DORA?
We advise on what DORA means in practice for your IT. The regulatory interpretation remains with your compliance and internal audit functions, and we align the implementation with it.
Why is access rights management so important under DORA?
Because access control is one of the points an audit examines most closely. Without a role model, defined joiner and leaver processes and recertification, you cannot prove that only authorised people access your systems.
DORA
Let's talk about your DORA project
Tell us where your organisation stands. We will tell you which parts we can take on and where others are the better contacts.