DORA: ICT Risk Rules for Financial Entities

What the DORA ICT risk rules require

The Digital Operational Resilience Act, Regulation (EU) 2022/2554 (DORA), has applied since 17 January 2025 (Article 64 DORA). It sets uniform rules for how banks, investment firms, payment and e-money institutions, insurers, fund managers, crypto-asset service providers, trading venues and other financial entities manage technology risk. The DORA ICT risk rules rest on five pillars: an ICT risk management framework owned by the management body, the classification and reporting of ICT-related incidents, digital operational resilience testing, the management of ICT third-party risk, and information sharing. As a regulation, DORA applies directly in Germany; national law adds supervisory powers and sanctions.

For German institutions DORA replaced much of the earlier national guidance on IT risk. BaFin supervises compliance for the entities it supervises, and the ECB is involved for significant credit institutions in the SSM. For many firms the main shift has been from principles-based IT supervision to detailed, harmonised requirements with fixed documentation, reporting templates and contract terms, backed by regulatory and implementing technical standards adopted by the Commission.

Governance and the DORA ICT risk management framework

Financial entities must have an internal governance and control framework that ensures effective and prudent management of ICT risk (Article 5(1) DORA). The management body defines, approves, oversees and is responsible for all arrangements related to the ICT risk management framework and bears the ultimate responsibility for managing the entity's ICT risk (Article 5(2) DORA). It sets the digital operational resilience strategy, including the risk tolerance for ICT risk, approves policies on availability, authenticity, integrity and confidentiality of data, allocates budget and must keep its own knowledge of ICT risk up to date.

The ICT risk management framework itself must be sound, comprehensive and well documented, part of the overall risk management system and able to address ICT risk quickly and efficiently (Article 6(1) DORA). It includes strategies, policies, procedures, protocols and tools to protect all information and ICT assets. The following articles specify the components: identification of ICT assets and dependencies, protection and prevention, detection of anomalies, response and recovery, backup and restoration, learning and evolving, and communication. Smaller entities, such as small and non-interconnected investment firms and exempted payment and e-money institutions, follow a simplified framework under Article 16 DORA.

Incident classification and reporting

Financial entities must establish a process to detect, manage and notify ICT-related incidents, record them and classify them according to criteria such as the number of affected clients, duration, geographical spread, data losses, criticality of services and economic impact. Major ICT-related incidents must be reported to the relevant competent authority (Article 19(1) DORA), in Germany generally BaFin, through an initial notification, an intermediate report and a final report. The deadlines and templates are set out in delegated and implementing acts and are short: the initial notification must follow within hours of classifying an incident as major.

Entities may also notify significant cyber threats voluntarily, and must inform clients without undue delay where a major incident affects their financial interests. Reporting under DORA sits alongside other regimes: personal data breaches still require notification to the data protection authority under the GDPR, and certain entities may have duties under the German NIS2 implementation. Incident response plans should map all applicable reporting lines, assign who decides on classification and who signs off reports, and avoid inconsistent statements to different authorities.

Digital operational resilience testing

Every financial entity other than microenterprises must maintain a risk-based testing programme covering vulnerability assessments, network security assessments, gap analyses, scenario-based tests, compatibility and performance testing and source code reviews where feasible.

Entities identified by the competent authority on the basis of systemic and ICT risk criteria must carry out advanced threat-led penetration testing (TLPT) at least every three years, covering several or all critical or important functions on live production systems (Article 26(1), (2) DORA). The EU framework builds on the TIBER-EU methodology. In Germany, the supervisory authorities are the competent authorities under Article 46 DORA, and BaFin carries out its tasks on TLPT under Articles 26 and 27 together with the Deutsche Bundesbank (§ 6(1g) KWG).

ICT third-party risk and contract terms under DORA

The third-party pillar has had the greatest practical impact. Financial entities remain fully responsible for compliance when they use ICT services (Article 28(1) DORA). They must maintain a register of information on all contractual arrangements for ICT services at entity, sub-consolidated and consolidated level, distinguishing those that support critical or important functions, and report it to the competent authority at least yearly (Article 28(3) DORA). Before contracting they must assess concentration risk and the provider's suitability, and they need exit strategies for services supporting critical or important functions.

Article 30 DORA prescribes minimum contract terms. Every ICT contract must be in writing and include a clear description of the services and any permitted subcontracting, the locations where services are provided and data processed, provisions on data protection, access, recovery and return of data on insolvency or termination, service level descriptions, assistance in ICT incidents at no or pre-agreed cost, cooperation with competent and resolution authorities, termination rights and participation in security awareness programmes. Contracts for services supporting critical or important functions require further terms, including detailed service levels, notice periods, audit and access rights, exit plans and mandatory transition periods.

Proportionality, groups and intra-group services

DORA applies the principle of proportionality throughout: financial entities implement the requirements taking into account their size and overall risk profile and the nature, scale and complexity of their services, activities and operations. In practice this affects the depth of documentation, the frequency of reviews and the extent of testing, but not whether a requirement applies. Small entities that qualify for the simplified ICT risk management framework under Article 16 still need a documented framework, monitoring of ICT systems, incident handling, business continuity arrangements and regular review, only in a less granular form.

Groups face particular questions. Many German banks and insurers receive IT services from a group service company. Intra-group ICT services are ICT third-party services under DORA, so the contract requirements of Article 30 and the register of information also cover them, although concentration risk and exit strategies can be assessed with the group context in mind. Groups should decide whether to maintain one consolidated register and one set of contract templates, and how responsibilities are allocated between the parent's and the subsidiaries' management bodies. The DORA ICT risk framework of each regulated entity must still be approved by that entity's own management body.

Another recurring issue is the interface between ICT third-party risk and outsourcing. Not every ICT service is an outsourcing, and not every outsourcing involves ICT. Where an arrangement is both, the entity must meet the DORA contract terms and the applicable national or sectoral outsourcing rules at the same time, and should align its outsourcing register with the DORA register of information to avoid inconsistent reporting.

Critical ICT providers and German implementation

DORA also creates an EU oversight framework for critical ICT third-party service providers, such as major cloud providers, designated by the European Supervisory Authorities. Each designated provider has a lead overseer with powers to request information, conduct inspections and issue recommendations (Articles 31 to 44 DORA). The oversight does not relieve financial entities of their own duties; they must still manage the risk of relying on these providers and may be required to suspend or terminate contracts if a provider does not follow recommendations.

In Germany, legislation adjusting financial supervisory law to DORA amended the Banking Act, the Insurance Supervision Act, the Payment Services Supervision Act, the Capital Investment Code and other statutes, designating BaFin as the competent authority and providing for administrative fines. For banks, the general requirement of a proper business organisation in § 25a KWG continues to apply alongside DORA, and outsourcing rules apply to non-ICT outsourcing. Entities should therefore check DORA ICT risk compliance together with their national organisational duties, and also consider sector-specific requirements, for example for crypto-asset service providers under MiCAR, discussed in our insight on MiCAR CASP authorisation in Germany.

Building a DORA ICT risk compliance programme

Two years after the application date, supervisors focus on effectiveness rather than paper compliance. A sound DORA ICT risk programme typically includes:

1. a gap analysis against Articles 5 to 30 DORA and the technical standards, with ownership assigned to named functions;
2. documented management body decisions on the resilience strategy, risk tolerance and budget, and regular training for board members;
3. a complete inventory of ICT assets, information assets and critical or important functions, with mapped dependencies on third parties;
4. an incident classification and reporting playbook aligned with GDPR and, where relevant, NIS2 reporting;
5. a contract remediation project for ICT agreements, feeding into the register of information;
6. a testing plan, including TLPT preparation where the entity has been or may be identified.

For ICT service providers that are not themselves financial entities, DORA ICT risk requirements arrive through customer contracts and audits. Providers serving the German financial sector should prepare standardised responses and contract terms, which is often a commercial advantage. Our pages on financial regulation and BaFin licensing and cybersecurity, NIS2 and the CRA explain related obligations.

How TRW & Co helps

We advise financial entities and ICT service providers on DORA and the related German supervisory rules. We carry out gap analyses, draft governance documents and policies, design incident reporting processes, review and negotiate ICT contracts against Article 30 DORA, and support the build-up of the register of information. For providers, we prepare DORA-compliant contract templates and negotiate with financial-sector customers. When BaFin raises questions or an incident occurs, we help with reporting and supervisory communication, together with our data protection colleagues. This page is general information, not legal advice. To discuss your programme, please contact us.