DORA consulting and implementation
DORA compliance in practice: reuse what you have, build evidence
We help smaller financial entities in Germany and their ICT service providers implement DORA, under the full framework of Articles 5-15 as well as under the simplified framework of Article 16. We reuse existing BAIT and VAIT documentation where it fits. What you get is verifiable evidence, such as a list of critical or important functions, a recovery test record and a reporting chain you have rehearsed.
What does DORA compliance require in Germany?
DORA, Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, has applied directly in every Member State since 17 January 2025. According to BaFin, the German financial supervisor, there will be no further transition period. It covers ICT risk management, incident handling and reporting, resilience testing and ICT third-party risk. Most financial entities apply the full framework of Articles 5-15, some smaller ones the simplified framework of Article 16 (see the section below).
For the full framework and Articles 28-30, BaFin considers the content of its IT circulars BAIT and VAIT to be largely reflected in DORA, while DORA also adds new duties such as the register of information. If you have worked to BAIT or VAIT so far, you are not starting from zero. Which framework applies to your entity has to be assessed case by case. We provide general information and build on your classification.
How we help
Pick the modules you need. For most entities, the gap analysis is the best place to start.
Where do we stand?
DORA gap analysis
Your documents and processes compared with your framework, with prioritised gaps and an action plan. From a document quick check to a full framework analysis.
DORA gap analysisWhich framework applies?
Document your classification
Whether DORA applies, full framework or Article 16, and whether you qualify as a microenterprise: we record your result in a classification record, based on your information. Borderline cases are for your legal counsel.
DORA applicabilityWhat applies under Article 16?
Simplified framework under Article 16
Which requirements are no longer expressly provided for, which tasks remain and which documents the RTS requires, article by article.
DORA Article 16 overviewLeaving BAIT in 2027?
Move to the simplified framework
For institutions under Section 1a(2a) KWG: rework BAIT documentation, redefine roles, set up the procedures of RTS 2024/1774 Title III, run drills and hand over evidence, as a service with a fixed base scope.
Transition from BAITWhat is critical?
Critical or important functions
The classification under Article 3(22) DORA drives the register, contracts, incident reporting and testing. We work with you on a reasoned list of functions.
What if something happens?
Reporting process and drill
Who classifies, who decides to report, and how do you file the initial notification within 4 hours of classifying an incident as major, and no later than 24 hours after becoming aware of it? We write the process and rehearse it with you.
Client sends DORA clauses?
Requirements for ICT service providers
Answer your financial clients’ Article 30 clauses, questionnaires and register data requests on the subject matter, and put together an evidence pack. Legal review of the clauses is for your legal counsel.
DORA for ICT providersDeliverables you can show
How you and your management body can tell that DORA has arrived in day-to-day operations. The selection is our suggestion, not a statutory list.
01
Classification record
Which framework applies based on your information (full, Article 16 or none), whether you meet the microenterprise criteria and whether Articles 28-30 apply, with figures and legal references. We flag borderline cases for your legal counsel.
02
Evidence matrix
Every requirement of your framework with status, owner, evidence and storage location, under Article 16 along Articles 28-41 of RTS 2024/1774.
03
Function list with recovery objectives
Critical or important functions with rationale, systems and providers. Under Article 16, too, the RTS requires a business impact analysis and recovery objectives (RTS Article 28(2)(d), Article 39(2)(d)).
04
Recovery test record
Backup and restoration tested for a critical or important function, with times, deficiencies and a report to the management body (RTS Article 40, under the full framework Article 11(6) DORA).
05
Incident reporting drill
A scenario from detection through classification to the initial notification, with times, decisions and gaps. Chapter III of DORA applies under both frameworks.
06
Management report and annual calendar
Status, open risks and decisions on a few pages, plus a calendar of recurring duties. Responsibility stays with the management body (Article 5(2) DORA, RTS Article 28(2)).
Typical starting points and the next step
Where entities come from when they start with DORA, and what the regulation, German law or BaFin say about it.
| Starting point | What DORA, the KWG or BaFin say | Next step |
|---|---|---|
| Factoring or leasing firm, BAIT so far | Institutions under Section 1a(2a) with Section 65a(3) KWG (here: the KWG group): Article 16 instead of Articles 5-15 from 1 January 2027, incident reporting under Chapter III already since 17 January 2025. BaFin will repeal BAIT in full at the end of 2026. | Check the reporting process, plan the move to Article 16 |
| Few staff, “we must be a microenterprise” | Microenterprise under Article 3(60) DORA: fewer than 10 persons and an annual turnover and/or balance sheet total not exceeding EUR 2 million. Only microenterprises within the KWG group are exempt from Articles 28-30. | Record your figures in the classification record, clarify borderline cases legally using our applicability page |
| Small payment or e-money institution | Not an Article 16 case in Germany, because Germany did not use the exemptions in the Payment Services and E-Money Directives. The full framework applies. | Gap analysis against the full framework |
| Full framework, BAIT or VAIT documents in place | BaFin considers BAIT/VAIT content largely reflected in DORA. New elements include the digital operational resilience strategy (Article 6(8)) and the register of information (Article 28(3)). | Map existing material against DORA, add what is new |
| Reporting process never rehearsed | Initial notification within 4 hours of classification as major, and no later than 24 hours after becoming aware (RTS 2025/301 Article 5). | Define classification and reporting chain, then run a drill |
Our own assessment based on the sources listed below, as of 6 November 2026. Not legal advice.
How do we work?
Five steps from the first call to ongoing operations.
1
Initial call
Your entity, framework, trigger, existing documents and your IT set-up including providers. Without obligation.
2
Classification and gap analysis
Record the framework, compare what you have with the requirements, rank gaps by risk and effort.
3
Rework and implementation
Rework existing policies and procedures, assign roles, implement measures with your IT team and providers.
4
Drills
Run a recovery test and an incident reporting drill, analyse deficiencies and report them to the management body.
5
Evidence and annual calendar
Hand over the evidence matrix, anchor recurring duties in a calendar, prepare the framework review.
An implementation plan sets the order in which you close gaps. It does not postpone any duty: what applies to your entity applies from its application date. You get a plan for your case from the gap analysis.
Your contact
Christian Gebhardt · Founder and Managing Director, Blackfort Technology
Your contact is Christian Gebhardt, Founder and Managing Director. Who works on the project is set out in our proposal.
We usually reply to your enquiry within 1-2 working days.
Simplified framework under Article 16: what changes on 1 January 2027
Our first focus is on entities under the simplified framework of Article 16. In Germany these are small and non-interconnected investment firms, small institutions for occupational retirement provision (IORPs, for the threshold and the borderline case see our applicability page), insurance holding companies (Section 293(5) VAG) and, from 1 January 2027, the institutions under Section 1a(2a) KWG (the KWG group), such as factoring and finance leasing firms and guarantee banks (Bürgschaftsbanken). The BAIT apply to the KWG group until 31 December 2026, DORA incident reporting since 17 January 2025. Threat-led penetration testing (TLPT) under Articles 26 and 27 does not apply to them. Article 16 is not a general relief for small firms: payment and e-money institutions in Germany are not covered.
Some BAIT requirements have no express counterpart under Article 16, such as the IT strategy or a designated information security officer. Most tasks behind them remain, and Articles 28-30 on ICT third-party risk apply in principle, except for microenterprises in the KWG group. On our reading we plan for the testing programme of Articles 24 and 25 DORA as a precaution. Our Article 16 page explains why and shows the details, and the questions of factoring and leasing firms are answered on our page on factoring and leasing.
ICT service providers to financial entities
Software vendors, managed service providers, data centres and telecoms providers feel DORA through their financial clients’ contracts. DORA obliges the financial entities, which have to include certain terms: the minimum terms of Article 30(2) DORA for all ICT contracts, the additional terms of Article 30(3) for services supporting critical or important functions, subcontracting rules and data for the client’s register of information, such as an LEI or EUID.
ICT service providers have no incident reporting duty under DORA, although an incident on their side can trigger their client’s duty. Only ICT third-party service providers designated as critical by the European Supervisory Authorities have obligations of their own under DORA. The gap analysis has a variant for providers.
Who is DORA-Readiness for, and where does our experience come from?
For smaller financial entities under the full or the simplified framework, including German entities of international groups, and for their ICT service providers. DORA-Readiness is a service by Blackfort Technology, Bonn, owner-managed since 2017. The responsible consultant is Christian Gebhardt, founder and managing director. We work in German and English.
Our DORA experience comes from three engagements: the completed DORA programme of a large German insurance group (on behalf of an international management consultancy, 02/2024-10/2025), a DORA and PKI engagement with an institution for occupational retirement provision (since 10/2025) and an ISMS engagement with a factoring firm moving to Article 16 (since 07/2026). We do not name clients.
What we do not do
To set expectations:
- No legal advice. On classification, framework and contracts we give general information. Have your individual case reviewed by legal counsel.
- We do not issue a “DORA certificate” or confirm DORA compliance. There is no DORA certification for companies.
- We do not take over your management body’s responsibility for the ICT risk management framework. We provide the basis for its decisions.
- We are not BaFin, do not audit on its behalf and cannot promise how supervisors or auditors will assess any evidence.
The pages on this website provide general information on the regulation, German law and supervisory practice. Whether a duty applies to your organisation has to be assessed case by case.
Frequently asked questions
How does the initial call work?+
By phone or video. We talk about your entity, the framework, the trigger and the documents you already have. Afterwards you know whether a gap analysis makes sense and which variant fits. For a gap analysis it is followed by a scoping call, often in the same session, in which we confirm scope and price for the proposal. The call does not commit you to anything.
Is there a DORA certification?+
No. There is no DORA certification for companies, and we do not offer one. What counts is a framework applied in practice, with evidence such as a maintained evidence matrix and the records of your drills. DORA certificates for individuals say nothing about your entity.
We are an ICT provider. Does DORA apply to us?+
DORA obliges financial entities. As a provider you are affected through your clients’ contracts, which have to contain certain terms under Article 30 DORA. Obligations of your own under DORA only arise if the European Supervisory Authorities designate you as a critical ICT third-party service provider.
Do you work remotely or on site?+
Both. Document reviews, interviews and coordination work well by video. On-site sessions, for example a reporting drill with the management body, are set out in our proposal.
What does implementation cost?+
That depends on the framework, your starting point and how much your team does itself. We publish prices with scope limits for the gap analysis on its page. For further implementation you receive a proposal with a fixed scope after the initial call or the gap analysis.
Read more
- DORA gap analysis: quick check, Article 16 and full framework
- DORA Article 16 transition: moving from BAIT to the simplified framework
- DORA Article 16: the simplified ICT risk management framework
- DORA for factoring and leasing: obligations and evidence from 2027
- DORA scope: who does DORA apply to, and which framework?
- BAIT and DORA: repeal, transition and the mapping as Excel
- Classifying critical or important functions under DORA
- DORA incident reporting: classifying and reporting ICT-related incidents
- About us: DORA-Readiness by Blackfort Technology, Bonn
Sources
- Regulation (EU) 2022/2554 (DORA) (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2024/1774 (ICT risk management, Title III simplified framework) (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2025/301 (content and time limits of incident reports) (retrieved 2026-11-06)
- Section 1a German Banking Act (KWG), German (retrieved 2026-11-06)
- Section 65a German Banking Act (KWG), German (retrieved 2026-11-06)
- Section 293 German Insurance Supervision Act (VAG), German (retrieved 2026-11-06)
- BaFin notice of 9 January 2025 on changes to the supervisory IT requirements, German (retrieved 2026-11-06)
- BaFin: FAQ on DORA, German (retrieved 2026-11-06)
- BaFin FAQ on DORA: will there be transitional periods? (German) (retrieved 2026-11-06)
- BaFin supervisory notice of 21 August 2025 on the simplified framework under Article 16 DORA (PDF, German) (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).
Last updated: 2026-11-06
Get in touch
Discuss your DORA project
Tell us briefly what kind of entity you are, which framework you think applies and who runs your IT. In the initial call, by phone or video, we agree the next step.