Entry service
DORA gap analysis: what is missing and what comes first
The DORA gap analysis compares your documents and processes with the framework that applies to you, the full framework of Articles 5-15 or the simplified framework of Article 16, and shows what to do first. You choose between a document quick check, an Article 16 gap analysis and a full framework gap analysis, with a separate variant for ICT service providers. The quick check and the Article 16 gap analysis have a fixed scope. For the full framework and for ICT providers, we agree scope and price in the scoping call. Each tier ends with a written report.
Which questions does the gap analysis answer?
Before you set budget and priorities for DORA, three questions need answers: which requirements apply to us, where do we already meet them with what we have, and what is missing most urgently?
The gap analysis answers these questions for your entity. We review your documents, hold workshops with IT, service providers and the people responsible, and compare each requirement of your framework with what is in place. We build on existing BAIT or VAIT documentation where it fits rather than having it rewritten. Where a requirement is no longer expressly provided for, we say so, together with the task that remains behind it.
For each requirement the report shows status, gap and action with priority and effort, so that your management body can set order and budget.
What you have after the analysis
The results depend on the tier. We walk you through the report in every tier.
01
List of gaps and priorities
The main gaps from the document review per topic area, with priority. Expressly not a full gap analysis and not an effectiveness review. Document quick check.
02
Classification documented
Which framework applies based on your information and whether you meet the microenterprise criteria, recorded in a classification record with figures and references. We flag borderline cases for your legal counsel. Article 16 and full framework gap analysis.
03
Evidence matrix with rating
Each requirement of your framework with reference, existing evidence, rating (in place, partial, missing) and gap. Article 16 and full framework gap analysis.
04
Action plan with effort estimate
Actions with priority, order, owners and effort as a basis for your budget. An improvement plan: it does not postpone any duty. Article 16 and full framework gap analysis.
05
Comparison with client requirements
For ICT service providers: your financial clients’ clauses and questionnaires against what you have, with an evidence pack and gaps. ICT provider variant.
06
Report and walkthrough
Written report and a walkthrough with you. For the Article 16 and full framework analyses also with the management body if you wish. All tiers.
Sample result: excerpt from a model report (fictitious)
This is what an excerpt from the evidence matrix of an Article 16 gap analysis looks like. Fictitious example, not a client: Muster-Factoring GmbH (23 employees, total assets of EUR 61 million, so not a microenterprise), under Article 16 from 1 January 2027, analysis carried out in 2026. A managed service provider operates network, workstations and file servers, and the factoring software runs as a cloud service at the software vendor.
| Requirement (reference) | Finding | Rating | Priority | Action |
|---|---|---|---|---|
| Business impact analysis approved by the management body (RTS Article 28(2)(d)) | Impact analysis from the BAIT contingency plan exists but is not tied to critical or important functions | partial | high | Draw up a function list, align the analysis with it, obtain approval |
| Recovery levels and time frames (RTS Article 39(2)(d)) | Restart times per server only, not per function. Dependency on the cloud service not stated | partial | high | Set objectives per function, include provider dependencies |
| Testing of backup and restoration at least annually (RTS Article 40) | Restore done by the providers, no record at the firm, deficiencies not reported to the management body | missing | high | Recovery test with record, analyse and report deficiencies |
| Initial notification within 4 hours of classification, no later than 24 hours after awareness (RTS 2025/301 Article 5) | Reporting process described since 2025, never rehearsed. Weekend cover not arranged | partial | high | Reporting drill, plan availability without relying on the weekend relief |
| Privileged access on a need-to-use basis, logged, strong authentication (RTS Article 33) | Provider holds permanent admin access, remote access without a second factor | partial | high | Access only when needed, log sessions, strong authentication for remote access |
| Clear responsibilities, segregation of control and audit functions (RTS Article 28(2)(b), 28(4), BaFin notice section 2.3) | Information security officer is also head of IT | partial | medium | Redefine roles, separate control tasks from IT |
| Minimum terms of ICT contracts (Article 30(2) DORA) | Cloud service contract without terms on assistance with ICT incidents | partial | medium | List missing mandatory terms per provider, legal review and renegotiation by the firm |
| Information security policy (RTS Article 29) | BAIT policy and twelve subordinate policies in place | in place | low | Align the policy with RTS Articles 30-38. Subordinate policies are no longer expressly required but remain usable |
Fictitious, shortened example with no link to any client. Ratings and priorities are illustrative. A real analysis covers every requirement of the framework. Whether the weekend relief in Article 5(4) of RTS 2025/301 applies to initial and intermediate reports of the KWG group is unresolved. The example plans without it. Rating scale: in place, partial, missing.
What do we assess?
Twelve topic areas to which we assign the requirements of your framework. References in brackets relate to the Article 16 framework (RTS = Commission Delegated Regulation (EU) 2024/1774). Under the full framework we assess the corresponding requirements of Articles 5-15 DORA and RTS Title II.
Who decides?
Governance and roles
Duties of the management body, responsibilities, segregation and independence of control and internal audit functions, reporting lines (RTS Article 28).
What is critical?
Functions and assets
Critical or important functions, supporting information and ICT assets and their interdependencies, including those at providers (RTS Article 30).
How do we assess risk?
ICT risk management
Risk tolerance, regular documented risk assessment, threat and vulnerability monitoring, alert thresholds (RTS Article 31).
What is in the policy?
Information security policy
Whether the policy covers all measures of RTS Articles 30-38 and which existing BAIT policies remain usable (RTS Article 29).
Who has full access?
Access control
Need-to-know, need-to-use, least privilege, privileged and emergency access with logging, strong authentication for remote access (RTS Article 33).
What is still open?
ICT operations
Automated vulnerability scanning and patching, capacity, legacy systems, logging of events (German text: „Vorfälle“, incidents) relating to access control, operations and change (RTS Article 34(f)).
Is the data protected?
Data and network security
Protection of data at rest, in transit and in use, network security, secure deletion, remote working (RTS Article 35), physical security (RTS Article 32).
How do changes go live?
Acquisition, projects, changes
Testing and approval before production, project management, change procedure for all changes (RTS Articles 37, 38).
Can we recover?
Business continuity and backup
Business impact analysis, recovery levels and time frames, backups with scope and minimum frequency, annual tests (RTS Articles 39, 40).
Do we test enough?
Testing programme
ICT security testing plan (RTS Article 36) and the testing programme of Articles 24 and 25 DORA, which on our reading we also plan for under Article 16 as a precaution. Our Article 16 page explains why.
DORA Article 16What if something happens?
Incidents and reporting
Detection, classification under RTS 2024/1772, reporting chain and time limits under RTS 2025/301 (Chapter III DORA).
What do providers deliver?
ICT third parties
Articles 28-30 DORA with contract terms and register of information, under the full framework and under Article 16 alike. For microenterprises in the KWG group (institutions under Section 1a(2a) KWG), the remaining duties under Article 16 and RTS Articles 30, 39.
What does the DORA gap analysis cost, and what is included?
Choose the tier by framework and the depth you need. We agree which one fits and fix the scope in the scoping call, which follows the initial call or forms part of it.
| Service | Document quick check | Article 16 gap analysis | Full framework gap analysis | ICT service provider |
|---|---|---|---|---|
| For whom | Full framework or Article 16, first orientation | Entities under the simplified framework | Entities under the full framework | Providers with financial clients |
| Legal entities | one | one | one, more after scoping | one |
| Documents | up to 25 | up to 40 | after scoping | after scoping |
| Workshops (up to 3 hours each, by video) | none, kick-off and results call | up to 3 | after scoping | after scoping |
| ICT service providers covered | - | up to 5 | after scoping | up to 3 client requirement sets |
| Result | List of gaps and priorities | Evidence matrix, action plan | Evidence matrix, action plan | Comparison, evidence pack |
| Price | €2,900 net plus VAT | €4,900 net plus VAT | from €8,500 net plus VAT | after scoping |
Offered to businesses only (B2B). All prices net plus VAT. The document quick check and the Article 16 gap analysis are fixed prices for the scope above. Additional legal entities, documents, workshops or providers are priced separately. For the full framework gap analysis and the ICT provider variant we confirm the fixed price in our proposal after the scoping call. If you then commission our Transition from BAIT service for Article 16, the Article 16 gap analysis is credited against it, with details in the proposal. Not included in any tier: technical implementation, contract negotiations with providers, penetration testing and legal advice.
How does the gap analysis work?
Four phases. How long each takes depends on tier and size.
1
Scoping
Framework, size, legal entities, providers and existing documents. Choice of tier and fixed price.
2
Documents and workshops
You provide the documents, we review them and clarify open points in the workshops.
3
Analysis
Comparison per requirement, rating, gaps, prioritisation by risk and effort.
4
Report and walkthrough
Delivery of the report and walkthrough, with the management body if you wish.
We plan 10 working days for the report after the last workshop and complete documents, unless the proposal says otherwise. We do not need access to production systems or data.
Your contact
Christian Gebhardt · Founder and Managing Director, Blackfort Technology
Your contact is Christian Gebhardt, Founder and Managing Director. Who works on the project is set out in our proposal.
We usually reply to your enquiry within 1-2 working days.
Variant for ICT service providers
DORA obliges financial entities. It reaches ICT service providers through contracts. Typical are clauses with the minimum terms of Article 30(2) DORA, additional terms under Article 30(3) for services supporting critical or important functions, subcontracting rules under Commission Delegated Regulation (EU) 2025/532 and requests for register of information data such as an LEI or EUID.
In this variant we compare your financial clients’ requirements with your contracts, processes and evidence and put together an evidence pack you can reuse for further requests. We set scope and price after the scoping call, because both depend heavily on how many clients and services are involved.
What do we need from you?
A contact person
Someone with an overview of IT, organisation and providers, for example the information security officer or the head of IT.
Documents in advance
Policies, contingency and backup documents, contracts with ICT providers, reporting process, existing audit reports.
Time
For the workshops with IT and providers and, if you wish, a session with the management body for the walkthrough.
What the gap analysis is not
To set expectations:
- Not legal advice. Whether DORA applies and which framework is a question for the individual case. We record the classification based on your information and point out questions you should have reviewed legally.
- Not a certificate or confirmation of DORA compliance. Nor is it an audit by internal audit, the statutory auditor or BaFin.
- Not an effectiveness review or penetration test.
- No implementation, no contract negotiation and no legal contract review. You implement the actions yourself, with your provider or with us. We compare contracts with Article 30 DORA on the subject matter, your legal counsel reviews the clauses and your entity negotiates.
The report is our professional assessment to prepare your decisions. We cannot promise how supervisors or auditors will assess any evidence.
Frequently asked questions
Which tier fits us?+
If you need a quick orientation for the management body, the document quick check is enough. If you are under the simplified framework and need a sound action plan, the Article 16 gap analysis fits. The full framework gap analysis is meant for entities under the full framework, because many more requirements apply there, such as the digital operational resilience strategy, the ICT risk control function and the detailed requirements of RTS Title II.
Is the gap analysis legal advice?+
No. We assess organisational and technical implementation. Legal borderline cases, for example on classification or contract clauses, belong with your legal counsel. The report can serve as a working basis for that.
We move from BAIT on 1 January 2027. Is an analysis still worth it?+
Yes, especially then. The analysis shows which BAIT documents you can reuse and what will be missing after the switch. An action plan does not postpone any duty. It sets what you tackle first.
We are very small. Do Articles 28-30 apply to us?+
Articles 28-30 DORA, and with them the register of information, do not apply to microenterprises in the KWG group. For everyone else the register applies under Article 16 too. We record in the analysis whether you meet the criteria, based on your figures. Our applicability page explains the criteria and borderline cases. Dependencies on providers still have to be identified.
Can we show the report to BaFin or our auditor?+
The report is written for your internal decisions and makes no legally binding statements. What counts is your documented framework with evidence of the measures in place. The evidence matrix from the analysis helps you build and file that evidence.
Read more
- DORA compliance for smaller financial entities in Germany
- DORA Article 16 transition: moving from BAIT to the simplified framework
- DORA Article 16: the simplified ICT risk management framework
- DORA for factoring and leasing: obligations and evidence from 2027
- DORA scope: who does DORA apply to, and which framework?
- BAIT and DORA: repeal, transition and the mapping as Excel
- Classifying critical or important functions under DORA
- DORA incident reporting: classifying and reporting ICT-related incidents
- About us: DORA-Readiness by Blackfort Technology, Bonn
Sources
- Regulation (EU) 2022/2554 (DORA) (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2024/1774 (ICT risk management, Title III simplified framework) (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2025/301 (content and time limits of incident reports) (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2025/532 (subcontracting) (retrieved 2026-11-06)
- Section 1a German Banking Act (KWG), German (retrieved 2026-11-06)
- BaFin supervisory notice of 21 August 2025 on the simplified framework under Article 16 DORA (PDF, German) (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).
Last updated: 2026-11-06
Get in touch
Request a gap analysis
Tell us briefly what kind of entity you are, which framework you think applies and who runs your IT. In the initial call, by phone or video, we discuss your project. In the scoping call, which follows it or forms part of it, we choose the right tier. We confirm the fixed price in our proposal.