Transition to DORA · full framework
Cleaning up BAIT legacy: moving documents and roles to DORA
CRR credit institutions have applied the full DORA framework of Articles 5-15 since 17 January 2025 and have been outside the scope of the BAIT, BaFin's banking IT requirements, since that day. In many banks, however, policies, roles and evidence still follow the BAIT chapters. With the package "Cleaning up BAIT legacy" we move this legacy set to DORA and the RTS 2024/1774, align it with MaRisk and hand over the evidence. The basic scope described below costs from €29,400 net plus VAT. Larger scope is priced after the scoping call.
What applies to CRR credit institutions?
This page covers the full framework of Articles 5-15 DORA. Anyone conducting deposit and lending business is a CRR credit institution and has been covered by DORA under Article 2(1)(a) since 17 January 2025. Since the same day these institutions have been excluded from the scope of the BAIT. BaFin repeals the BAIT completely at the end of 31 December 2026. According to BaFin there will be no further transitional period for DORA.
As early as June 2024 BaFin compared BAIT chapters 1 to 10 with the full framework and found their content essentially covered. DORA also adds new items, such as the digital operational resilience strategy and the ICT risk control function. MaRisk continues to apply alongside DORA, now in its 9th amendment (Circular 06/2026 (BA), as of 30 June 2026), with its own requirements on ICT strategy, risk inventory, contingency management and outsourcing.
The package therefore cleans up your legacy set: BAIT references are replaced by DORA and RTS references, documents are merged, missing parts are added and the interfaces to MaRisk are clearly assigned. Arrangements and safeguards that work stay in place.
What does the "Cleaning up BAIT legacy" package include?
Seven building blocks that build on each other. References without a source refer to DORA, "RTS" means Delegated Regulation (EU) 2024/1774, Title II.
What do we already have?
Review with the BAIT-DORA mapping
We map every document to the rows of the BAIT-DORA mapping and use the status column for the full framework: stricter, unchanged, no express requirement any more, or new. With you we decide: keep, rework or merge. Where a requirement has no express counterpart, we clarify which task remains.
BAIT-DORA mappingWhich documents does the full framework require?
Framework, policies and procedures
The ICT risk management framework under Article 6 with the DOR strategy (Article 6(8)), plus the RTS policies and procedures on security, human resources and access, detection and response, and business continuity. We drop the BAIT structure where it gets in the way of mapping to DORA.
ICT risk managementWhat happens to the CISO?
Roles and ICT risk control function
The management body is responsible for the framework (Article 5(2)). BaFin compares the control function under Article 6(4) with the information security officer (ISB) of the BAIT, whose focus is more on information security. MaRisk allows it to be combined with the compliance function (AT 4.4.2). We clarify set-up, independence and contract monitoring under Article 5(3) with you and prepare the resolution.
How does MaRisk fit in?
Alignment with MaRisk
ICT strategy under AT 4.2, which may form one document with the DOR strategy. ICT risks in the risk inventory (AT 2.2). Contingency plan under AT 7.3 for critical or important functions alongside BIA and recovery objectives under Articles 11 and 12. AT 9 for third-party sourcing not covered by Articles 28-30. We also check whether the change is a material change under AT 8.2.
MaRisk and DORAWhat is critical?
Function list, BIA and recovery objectives
Critical or important functions with reasons, business impact analysis (Article 11(5)) and recovery time and recovery point per function (Article 12(6)), aligned with the overview of functions from MaRisk contingency management. The classification is not the same as the materiality of an outsourcing arrangement.
Classify functionsDoes it work when it matters?
Recovery and reporting exercise
A recovery exercise for one critical or important function and a tabletop reporting exercise up to the initial notification: within 4 hours of classifying the incident as major, at the latest 24 hours after becoming aware of it. For initial and intermediate reports of credit institutions the weekend rule does not apply. Deficiencies go to the management body in a report.
DORA incident reportingWhere is the evidence?
Contracts, evidence matrix and annual calendar
Subject-matter check of ICT contracts against Article 30, including intra-group ones, for which, according to BaFin, the previous waiver of exit processes under AT 9 para. 15 MaRisk no longer applies. Plus each duty with evidence, owner and storage location and a calendar of recurring duties from DORA and MaRisk.
Managing ICT providersWhat you have at the end
We hand over the results as drafts for your institution to adopt and as an organised evidence file.
01
Mapping of your BAIT documents
All documents with a decision (keep, rework, merge) and the row in the BAIT-DORA mapping.
02
Framework, DOR strategy, policies and procedures
As drafts, BAIT references replaced, reworked from your existing texts wherever possible.
03
Role model with draft resolution
Management body, ICT risk control function, compliance, contract monitoring and internal audit with clear responsibilities.
04
MaRisk interface list
Which requirement DORA leads and where MaRisk adds to it, for AT 2.2, AT 4.2, AT 7.3 and AT 9.
05
Exercise records
Record of the recovery exercise and evaluation of the reporting exercise, each with deficiencies, actions and a report to the management body.
06
Evidence matrix and annual calendar
Each duty with evidence and storage location, calendar of recurring duties with owners.
Example: decision per BAIT chapter at a regional bank
This is how the result of the review can look for individual chapters. A fictitious example, no commitment and no statement about your documents.
| BAIT chapter (document) | Reference today | Finding | Decision |
|---|---|---|---|
| 1 IT strategy | AT 4.2 MaRisk, Article 6(8) DORA | IT strategy in place, no DOR strategy | rework, ICT and DOR strategy in one document |
| 4 Information security management (ISB policy) | Article 6(4) DORA, AT 4.4.2 MaRisk | ISB role described, responsibility for ICT risk unclear | rework, define control function, prepare resolution |
| 9 Outsourcing and other external IT procurement | Articles 28-30 DORA, AT 9 MaRisk | one policy for all cases, BAIT references | split: ICT services under DORA, other sourcing under AT 9 |
| 10 IT contingency management | Articles 11 and 12 DORA, AT 7.3 MaRisk | contingency plan in place, no recovery objectives per function | keep, add BIA and objectives |
Fictitious example by Blackfort Technology, no commitment to results.
What does the clean-up cost, and where are the limits?
From €29,400 net for the basic scope below: 21 person-days at €1,400. More legal entities, documents, workshops or providers are priced after the scoping call.
| Building block | Included | Person-days |
|---|---|---|
| Review and mapping | one legal entity, up to 60 BAIT documents | 3 |
| Rework of framework, policies and procedures | up to 12 drafts, including a draft DOR strategy or alignment of an existing one | 6 |
| Roles and governance | role model with ICT risk control function under Article 6(4) DORA, draft resolutions | 1.5 |
| Function list, BIA and recovery objectives | up to 10 ICT providers in the function list, check against Article 30 | 3 |
| Alignment with requirements that continue to apply | MaRisk AT 2.2, AT 4.2, AT 7.3 and AT 9, interface list | 1.5 |
| Recovery and reporting exercise | one each. Recovery for one critical or important function, planned, supported and recorded by us and run by your IT or your provider. Reporting exercise as a tabletop of up to 3 hours | 2 |
| Evidence matrix, annual calendar and handover | evidence matrix with storage locations, calendar of recurring duties | 1.5 |
| Project management and workshops | up to 8 workshops of up to 3 hours each, video or on site, of which 2 with the management body | 2.5 |
| Total | day rate €1,400 net | 21 |
| Price | from €29,400 net plus VAT for this basic scope |
Offer for businesses only (B2B). More legal entities, documents, workshops or providers are priced after the scoping call and stated in the offer. A full framework gap analysis commissioned beforehand is credited, details in the offer.
How does the clean-up work?
Four phases. The duration depends mainly on how quickly documents, meetings and resolutions come together.
1
Review
Map the BAIT documents to the mapping, decide per document, draft the function list and business impact analysis.
2
Framework, roles and strategy
Role model with control function, framework and DOR strategy aligned with the ICT strategy under AT 4.2 MaRisk, management body resolution.
3
Policies, procedures and interfaces
Rework policies and procedures, align contingency plan and recovery objectives, check contracts against Article 30, settle the interfaces to MaRisk.
4
Exercises and handover
Recovery and reporting exercise, evidence matrix, annual calendar.
The duties have applied since 17 January 2025, regardless of how far the clean-up has progressed. What is needed in an incident therefore comes first: clear roles and a working reporting process.
Your contact
Christian Gebhardt · Founder and Managing Director, Blackfort Technology
Your contact is Christian Gebhardt, Founder and Managing Director. Who works on the project is set out in our proposal.
We usually reply to your enquiry within 1-2 working days.
Clean-up, topic pages or gap analysis?
The page BAIT and DORA explains the repeal and transition and provides the mapping as an Excel file. The page MaRisk and DORA explains the interfaces of the 9th amendment in detail. This package applies both to your legacy set and hands over the results.
The package "Transition from BAIT" is a different case: it is aimed at factoring and leasing institutions and the other institutions under Section 1a(2a) KWG that move to the simplified framework of Article 16 on 1 January 2027. CRR credit institutions apply the full framework.
The full framework gap analysis shows where you stand and what to do in which order, and leaves open who implements it. You can start with it and commission the package afterwards, in which case it is credited, details in the offer.
Who else can use the package
The German state development banks (Section 1a(2) KWG) and KfW also apply the full framework. Where their documents still follow the BAIT structure, the package fits as well. For institutions directly supervised by the ECB, MaRisk does not apply. Alignment then follows the requirements that apply there and is tailored in the offer.
Whether your institution is a microenterprise (fewer than ten employees and annual turnover and/or balance sheet total of no more than EUR 2 million) is recorded at the start and not assumed. For microenterprises some duties of the full framework do not apply, for example the independent control function under Article 6(4).
Who is responsible for the package
The responsible consultant is Christian Gebhardt, founder and managing director of Blackfort Technology. We have been owner-managed since 2017.
What does your institution contribute?
One contact person
For example the ISB, the ICT risk control function or the head of IT, with about half a day to one day per week for meetings, documents and reviewing drafts.
The management body
Two meetings and the resolutions on roles, framework, strategy and business impact analysis. Responsibility for the framework stays with the management body.
Business functions and providers
Risk controlling, compliance, contingency and outsourcing management for the MaRisk interfaces. IT and providers for information, the recovery exercise and the reporting exercise.
What is not part of the package?
So that expectations match:
- No technical implementation. Your IT or your provider sets up strong authentication, logging or vulnerability scanning. We describe the requirement and review the evidence.
- No contract negotiation and no legal contract review. The check against Article 30 DORA is a subject-matter check. Drafting and reviewing clauses is for your legal counsel. Building and submitting the register of information is not part of the package.
- No assumption of roles. We take on the ICT risk control function, an external CISO role or internal audit only under a separate mandate.
- No commitment as to how supervisors, external auditors or internal audit will assess the result. No certificate, no legal advice.
The information on this page is general information on DORA, RTS 2024/1774 and MaRisk Circular 06/2026 (BA) as of 6 November 2026. Whether and how it applies to your institution must be assessed case by case.
Frequently asked questions
Do the BAIT still apply to us?+
No. CRR credit institutions have been excluded from the scope of the BAIT since 17 January 2025 and apply the full DORA framework. The BAIT are repealed completely at the end of 31 December 2026, because they still apply to other institutions until then.
Do we have to throw away our BAIT documents?+
No. Much of their content reappears in the full framework, often in stricter form. The review decides for each document whether it is kept, reworked or merged. Where a requirement has no express counterpart any more, we clarify which task remains.
Do we need an ICT strategy in addition to the DOR strategy?+
MaRisk requires an ICT strategy in AT 4.2. If an institution must have a DOR strategy, both may form one document. Both may also be integrated into the business strategy.
Is the gap analysis credited?+
Yes. A full framework gap analysis commissioned beforehand is credited against the package. Details are in the offer.
What happens after the handover?+
You run the framework yourself, with the annual calendar as a guide. On request we support the first review of the framework or the next exercise, agreed separately.
Read more
- BAIT and DORA: repeal, transition and the mapping as Excel
- MaRisk 9th amendment and DORA: interfaces from AT 2.2 to AT 9
- ICT risk management under DORA: framework and DOR strategy
- DORA gap analysis: quick check, Article 16 and full framework
- DORA Article 16 transition: moving from BAIT to the simplified framework
- Classifying critical or important functions under DORA
- DORA incident reporting: classifying and reporting ICT-related incidents
- ICT third-party risk under DORA: managing providers and Article 30 contracts
- DORA register of information: structure, mandatory fields, submission
Sources
- Regulation (EU) 2022/2554 (DORA), Articles 2, 5, 6, 11, 12, 28-30 (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2024/1774 (ICT risk management), Title II (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2025/301 (content and time limits of incident reports), Article 5 (retrieved 2026-11-06)
- BaFin news of 9 January 2025 on changes to IT requirements under DORA, in German (retrieved 2026-11-06)
- BaFin: Circular 10/2017 (BA) BAIT as amended on 16 December 2024 (PDF, German) (retrieved 2026-11-06)
- BaFin supervisory notice on implementing DORA in ICT risk management and ICT third-party risk management, as of June 2024, published 8 July 2024 (PDF, German) (retrieved 2026-11-06)
- BaFin: Circular 06/2026 (BA) MaRisk, as of 30 June 2026 (PDF, German) (retrieved 2026-11-06)
- BaFin DORA FAQ, question 13 (CRR credit institutions since 17 January 2025), in German (retrieved 2026-11-06)
- BaFin DORA FAQ: does implementing DORA constitute a material change under AT 8.2 MaRisk? (German) (retrieved 2026-11-06)
- BaFin DORA FAQ: management of ICT third-party service providers, question 04 (intra-group ICT providers), in German (retrieved 2026-11-06)
- German Banking Act (KWG), Section 1a, in German (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).
Last updated: 2026-11-06
Get in touch
Discuss the clean-up
Tell us briefly how large your institution is, how your documents are structured and who runs your IT. In the initial call, by phone or video, we clarify whether the package fits. In the following scoping call we agree scope, price and start date.