Who is behind DORA-Readiness

dora-readiness.de is run by Blackfort Technology UG (haftungsbeschränkt), a German limited liability company, Ernst-Robert-Curtius-Straße 8A, 53117 Bonn, Germany. The company has been entered in the commercial register of the Bonn Local Court since 2017 (HRB 23120) and is owner-managed. We work in information security, compliance and technical implementation: with us, regulatory classification and implementation in the systems come from the same project. The founder and managing director is Christian Gebhardt.

What DORA-Readiness is

DORA-Readiness brings together our DORA services for smaller financial entities and their ICT service providers: reusing existing BAIT and VAIT structures in a targeted way, avoiding unnecessary documentation and creating traceable evidence of implementation.

The service behind it is our DORA implementation consulting, with the DORA gap analysis as the entry point.

Founder and managing director: Christian Gebhardt

Christian Gebhardt, managing director since 2017

• Permanent member of the AI Expert Working Group
  Alliance for Cyber Security / BSI
• Co-author: “Guidelines for Penetration Testing of Large Language Models” (ACS/BSI)

Christian Gebhardt founded Blackfort Technology in 2017, alongside his role as an audit specialist at Deutsche Bank.

The professional background he brought with him continues to shape how Blackfort works today. He started as a working student at BWI Informationstechnik, the IT service provider of the German Federal Armed Forces, and stayed for seven years. From 2011 he worked there as an IT Solution Architect and systems engineer, responsible for directory services, identity and access management and the BWI PKI based on the PKI of the German Armed Forces. This was followed by roles at exceet Secure Solutions in the Gematik telehealth infrastructure with a focus on PKI and Hardware Security Modules, and at TÜV Trust IT, where he led ISO 27001 ISMS build-out projects at municipal critical infrastructure organisations.

Deutsche Bank opened the perspective of independent review: audit leadership in highly regulated domains (BAIT, MaRisk, ZAG, KRITIS) covering topics such as information security management, payment processing, PKI and data centre security. This experience often revealed just how far apart documented requirements and lived practice can be.

After his role as Information Security Officer at Gothaer Solutions GmbH, he became Deputy CISO in 2021, leading the information security team with a direct reporting line to the IT board member.

In parallel, from 2021 to 2023 he served as Managing Director of ArcSin GmbH, a company specialising in artificial intelligence and cryptography with a focus on massively parallel processing in distributed systems: an early engagement with AI architecture well before the topic became mainstream for security organisations.

In the field of AI security, he is a permanent member of the AI Expert Working Group of the Alliance for Cyber Security (ACS/BSI). He co-authored the ACS “Guidelines for Penetration Testing of Large Language Models” (2025) and wrote its first draft.

How we work

Our approach has five steps:

1. Understand systems and dependencies: which services, facilities, service providers and platforms your operations rely on.
2. Identify risks: where measures are missing or not effective.
3. Derive measures: a prioritised plan with owners and sequence.
4. Implement technically: together with your teams we implement configuration, processes and documentation.
5. Record evidence: so that management and auditors can follow what has been implemented.

Your enquiry is handled by Christian Gebhardt as founder, managing director and responsible consultant. Who else works on the project is set out in our offer. We work in German or English, by video conference and on site where the project requires it.

Our DORA experience

The responsible consultant for engagements arising through DORA-Readiness is Christian Gebhardt. From his DORA work we name three engagements:

• DORA programme of a large German insurance group, on behalf of an international management consultancy, from February 2024 to October 2025
• DORA and PKI engagement at an institution for occupational retirement provision (IORP), since October 2025
• ISMS engagement at a factoring institution in its transition to the simplified framework under Article 16 DORA, since July 2026

We do not name our clients, because confidentiality is part of consulting. What our work results look like is shown with fictitious examples on our topic pages, for instance the list of functions on our page on critical or important functions.

Blackfort Technology is a partner of Tenable, Rapid7 and DigiCert. These partnerships relate to security tools and certificate services.

What you can expect from us

• We back statements on laws and regulations with the provision and the date of the version we checked.
• We say what the law requires, what our recommendation is and what is an example, and keep these visibly apart.
• On DORA and other legal provisions we provide general information. The legal assessment of your case belongs in the hands of a lawyer.