The regulation leaves no room for delay. Almost all actors in the financial ecosystem and their technology partners are affected:

• Credit institutions, payment institutions, and e-money institutions
• Asset managers, investment firms, and insurance undertakings
• ICT third-party service providers: IT service providers that deliver critical services to financial entities (supply chain focus)
• The management body is directly liable for approving and monitoring the ICT strategy

With DORA fully in force, national supervisory authorities (such as BaFin) are conducting strict audits. A lack of compliance results in direct operational restrictions or severe administrative fines.

DORA demands a holistic approach that goes far beyond classic information security. We support you in implementing all five required core areas:

1. ICT risk management: Establishing, maintaining, and continuously reviewing a robust ICT risk management framework.
2. ICT-related incident management: Establishing a standardized process for detecting, managing, and reporting major ICT-related incidents to the authorities.
3. Digital operational resilience testing: Regularly conducting vulnerability analyses, network scans, and – for core systems – advanced threat simulations (TLPT / Threat-Led Penetration Testing).
4. ICT third-party risk management: Systematically monitoring and assessing risks arising from outsourcing to IT service providers, including the adaptation of contracts (SLA requirements).
5. Information sharing: Establishing processes for the secure exchange of cyber threat intelligence with other financial entities.

We support your organization and your IT service providers in a pragmatic and legally secure manner in implementing all regulatory requirements of the DORA regulation.

ICT Risk Management & Governance

• Establishing the ICT risk framework: Development and documentation of strategies, guidelines, and procedures to identify and mitigate ICT risks.
• Organizational consulting: Definition of roles and responsibilities for the management body and risk management in accordance with DORA requirements.
• Training programs: Implementation of mandatory awareness and training measures for executive decision-makers and IT teams.

Classification & Reporting of ICT-Related Incidents

• Implementation of detection systems: Optimization of your processes for the early identification of cyber-related incidents.
• Classification framework: Development of criteria for the rapid classification of incidents based on thresholds defined by the European Supervisory Authorities (ESAs).
• Structuring of reporting systems: Establishment of legally secure processes for the timely reporting of major incidents to supervisory authorities (e.g., BaFin).

Digital Operational Resilience Testing

• Testing programs (vulnerability assessments): Conception and implementation of vulnerability analyses, network scans, and source code reviews.
• TLPT preparation: Support and guidance in conducting advanced, threat-led penetration testing (TLPT) for core systems.
• Remediation plans: Structured processing of test results and seamless remediation of identified security risks.

ICT Third-Party Risk Management

• Supply chain & multi-vendor strategy: Assessment of concentration risks when outsourcing to IT and cloud service providers.
• Contract & SLA adjustments: Review and optimization of service provider contracts regarding the minimum contractual clauses required by DORA (e.g., access and audit rights).
• Third-party audits: Conducting risk analyses and audits directly at your critical service providers.

Crisis Organization & Information Sharing

• Business continuity for ICT: Creation of specific IT recovery plans and emergency scenarios (interfacing with ISO 22301).
• Threat intelligence sharing: Establishment of processes for the secure and privacy-compliant exchange of cyber threat information within financial clusters.