Transition to DORA · full framework and Article 16
Incident reporting and recovery drill under DORA
Whether reporting and recovery work in a real incident only shows when you try them. In our reporting and recovery drill we play through a major ICT-related incident as a tabletop exercise up to the report and support the recovery of a critical or important function, carried out by your IT or your provider. At the end you have records, a list of deficiencies with actions and a report to the management body. Fixed price €4,900 net plus VAT.
What does DORA require for reporting and recovery?
This service covers both frameworks: financial entities under the full framework and under the simplified framework of Article 16 DORA. The reporting obligation in Chapter III applies equally under both, and to institutions under Section 1a(2a) of the German Banking Act (KWG group) since 17 January 2025. The initial notification of a major ICT-related incident is due within four hours of classifying it as major and no later than 24 hours after becoming aware of it, the intermediate report no later than 72 hours after the initial notification (Commission Delegated Regulation (EU) 2025/301, Article 5).
For recovery the frameworks differ. Under the full framework, financial entities test their ICT business continuity plans and their ICT response and recovery plans at least yearly (Article 11(6) DORA) and, when setting recovery time and recovery point objectives for each function, take into account whether it is critical or important (Article 12(6)). Under the Article 16 framework, business continuity plans set out planned recovery levels and time frames (Article 39 of Commission Delegated Regulation (EU) 2024/1774, here: RTS) and are tested at least once a year with regard to backup and restoration. Deficiencies found go to the management body (RTS Article 40).
The drill checks both on a case from your own company and produces records as evidence. It contributes to the annual tests. It does not replace a full testing programme.
What does the drill include?
Six building blocks from preparation to report. Classification, time limits and forms are explained in detail on our incident reporting page (in German).
Does the scenario fit us?
Script for your company
We write a scenario with your functions, systems and providers: injects, expected responses, roles and evidence. The reporting drill is a Blackfort Technology recommendation for checking incident process and reporting channel together.
Classification and time limits (German)Who reports by when?
Tabletop reporting drill
Up to three hours at the table: classify the incident, work out the time limits for initial and intermediate reports, prepare the report, play through a reclassification or a delay. We only plan with the weekend rule where it clearly applies to your company. Where that is unresolved, for example for the KWG group, we practise without the relief. Nothing is sent to BaFin.
Do data and operations come back?
Recovery drill
For one critical or important function we plan scenario, objective, sequence and abort criteria with your IT or provider. Your IT or provider carries out the recovery, we observe and record whether the objectives in your plan were met.
Identifying critical functions (German)What was missing?
Evaluation with list of deficiencies
For both drills we record observations, causes and actions with owners and dates. We assess deficiencies from the recovery drill against your recovery objectives.
What does the management body learn?
Report to the management body
A short report with result, deficiencies and actions. Under the Article 16 framework, RTS Article 40 requires deficiencies found in the tests to be reported to the management body. Under the full framework the management body is responsible for all arrangements of the ICT risk management framework (Article 5(2) DORA).
How does the drill fit into the year?
Place in the testing programme
We show which tests are still due during the year: under the full framework the testing programme of Articles 24 and 25 DORA with yearly tests of systems supporting critical or important functions (Article 24(6)), under the Article 16 framework the ICT security testing plan of RTS Article 36 and, on our reading, Articles 24 and 25 DORA as well.
DORA Article 16What you have at the end
All results as documents for your evidence files.
01
Reporting drill script
Scenario, injects, roles and expected responses, reusable for later drills.
02
Reporting drill record
Times of awareness, classification and prepared report, calculated time limits, deviations.
03
Recovery drill plan
Function, scenario, objective from your plan, sequence, participants and abort criteria.
04
Recovery drill record
Sequence with timestamps, recovery time achieved and data point reached compared with the objective.
05
List of deficiencies with actions
Observation, cause, action, owner and date for both drills.
06
Report to the management body
Result, deficiencies and actions on a few pages, with a note on the tests still due this year.
Example: excerpt from a list of deficiencies
This is what the evaluation could look like at a fictitious leasing institution. An example, not a commitment: which deficiencies a drill reveals depends on your company.
| Drill | Observation | Cause | Action | Owner, date |
|---|---|---|---|---|
| Reporting drill | Classified as major only after 70 minutes, thresholds had to be looked up | no prepared classification sheet | Pre-fill the sheet with own services and thresholds | Incident owner, 4 weeks |
| Reporting drill | The deputy could not prepare the report because they had no MVP access | only one authorised person | Authorise a second person, arrange weekend cover | Senior management, 6 weeks |
| Reporting drill | Information on the cause came from the provider only after a query via the general hotline | no incident contact agreed | Agree a contact channel with the provider, have the contract reviewed legally | Provider management, next contract round |
| Recovery drill | Core system restored after 11 hours, objective 8 hours | Restoring the interfaces not described in the plan | Add the steps to the plan, repeat the drill for this part | Head of IT with provider, 3 months |
| Recovery drill | Data point was 26 hours old, objective 24 hours | last nightly backup failed without an alert | Set up monitoring of backup jobs with alerts | IT on-call, 2 weeks |
Fictitious example by Blackfort Technology, no client data and no commitment on results.
What does the drill cost, and where are the limits?
€4,900 net as a fixed price for one legal entity and the scope described below. The PD column shows the effort per building block in person days. Additional functions, legal entities or dates are priced after the scoping call.
| Building block | Included in the fixed price | PD |
|---|---|---|
| Preparation and script | one preparatory meeting of up to 2 hours on functions, plans, reporting process and participants, script for your company, recovery drill plan | 1 |
| Reporting drill | one, as a tabletop exercise of up to 3 hours by video or on site, with debrief | 0.5 |
| Recovery drill | one, for a critical or important function. Planning and observation by us, carried out by your IT or your provider | 1 |
| Evaluation, records, report | Records of both drills, list of deficiencies with actions, one report to the management body | 1 |
| Price | €4,900 net plus VAT, fixed price for this scope | 3.5 |
Offered to businesses only (B2B). PD = person days. Additional functions, legal entities or dates are priced after the scoping call and stated in our proposal. A gap analysis is not credited against this single service, only against the packages in the “Transition to DORA” series (Transition from BAIT, VAIT, KAIT, ZAIT and BAIT legacy clean-up). If you book our “Transition from BAIT” package, both drills are already included there.
How does the drill work?
Four phases. We set the order of the two drills around your diary.
1
Preparation
Preparatory meeting, choice of function for the recovery drill, review of business continuity plan and reporting process, script.
2
Reporting drill
Tabletop exercise with senior management, incident owners, IT, provider management and communications, debrief straight afterwards.
3
Recovery drill
Carried out by your IT or provider in the environment your IT chooses, observed and recorded by us.
4
Evaluation and report
List of deficiencies with actions, report to the management body, notes for the next tests.
The drill requires a documented reporting process and a business continuity or recovery plan with objectives for the chosen function. If neither exists, this is settled first, for example in the gap analysis or a transition package.
Your contact
Christian Gebhardt · Founder and Managing Director, Blackfort Technology
Your contact is Christian Gebhardt, Founder and Managing Director. Who works on the project is set out in our proposal.
We usually reply to your enquiry within 1-2 working days.
Drill, reporting page, transition or gap analysis?
Our DORA incident reporting page (in German) explains classification, time limits, the weekend rule and forms and contains a general drill script. If you want to run a drill yourself, start there. With this service we prepare the drill for your company, run it with you and evaluate it, and add the recovery drill.
If you book our “Transition from BAIT” package, one recovery drill and one reporting drill are already included there, so you do not need this service in the first year. The transition packages in the series for the full framework also include one of each. The DORA gap analysis checks whether reporting process and plans meet the requirements, the drill checks whether they work in practice.
Legal basis by framework
Full framework (Articles 5-15 DORA): tests of the ICT business continuity plans and of the ICT response and recovery plans at least yearly and after substantive changes to systems supporting critical or important functions, for entities other than microenterprises with cyber attack and switchover scenarios (Article 11(6)). Recovery time and recovery point objectives per function (Article 12(6)). Entities other than microenterprises have a crisis management function (Article 11(7)), which we include in the tabletop exercise. In addition, the testing programme of Articles 24 and 25 with yearly tests of all systems and applications supporting critical or important functions (Article 24(6), not for microenterprises).
Simplified framework (Article 16 DORA, RTS Title III): continuity of critical or important functions with backup and restoration measures, and regular testing (Article 16(1)(f) and (g)). Business continuity plans with planned recovery levels and time frames (RTS Article 39), tested at least once a year with regard to backup and restoration, deficiencies reported to the management body (RTS Article 40). The simplified framework provides for no crisis management function, but according to BaFin escalation plans are part of it. Articles 24 and 25 DORA contain no exemption for Article 16 entities, and on our reading we plan for them. No source says expressly whether Article 24(6) applies in full alongside the testing plan of RTS Article 36.
Reporting under Chapter III is the same in both frameworks. Besides the initial and intermediate reports it includes the final report no later than one month after the intermediate report or the last updated intermediate report. If a time limit cannot be met, the entity informs the authority within that time limit at the latest, with reasons. If an incident is classified as major only after more than 24 hours, the initial notification is due within four hours of classification.
Who is responsible for the drill
The responsible consultant is Christian Gebhardt, founder and managing director of Blackfort Technology, owner-managed since 2017.
What does your company contribute?
A contact person
For example the incident owner, the information security officer or the head of IT, for the preparatory meeting, documents and dates.
Tabletop participants
Senior management or a deputy, incident owners, IT, provider management, communications and data protection, for up to three hours.
IT and providers
Carrying out the recovery in an environment your IT chooses and is responsible for. We do not access your systems.
What is not included?
To set expectations:
- No technical execution. Your IT or provider carries out the recovery, and risk and responsibility for the systems stay with them. We have no access to your systems.
- No real report to BaFin and no legal advice, for example on classifying a real incident or on the weekend rule in an individual case.
- No full testing programme under Articles 24 and 25 DORA, no penetration tests, no TLPT. The drill covers one function. The evaluation shows whether your other tests meet the yearly requirements, it does not replace any of them.
- No drafting of business continuity plan, business impact analysis or function list. We assume these exist. No taking over of roles.
- No commitment on how supervisors or auditors will assess the drill. No certificate.
The assessments on this page are general information on the state of DORA, Commission Delegated Regulations (EU) 2024/1774 and 2025/301 and the KWG. Whether and how they apply to your company has to be checked in the individual case.
Frequently asked questions
Does the drill replace the annual test of our plans?+
It contributes to it. The recovery drill tests backup and restoration for one critical or important function. Whether your tests as a whole meet the requirements, under RTS Article 40 in the Article 16 framework or under Article 11(6) and Article 24 DORA in the full framework, depends on which functions and plans you have. The evaluation shows what still needs testing during the year.
Does the weekend rule apply in the reporting drill?+
If a time limit falls on a weekend or public holiday, the report may in principle be submitted by 12:00 on the next working day. This does not apply to initial and intermediate reports of, among others, credit institutions and of financial entities that are essential or important entities under NIS2. Whether the KWG group falls under this is unresolved. Where it is unresolved, we practise without the relief. Our incident reporting page (in German) has the details.
We have booked the “Transition from BAIT” package. Do we need the drill as well?+
Not in the first year, both drills are included in the package. For drills in later years you can book this service.
Do we report anything to BaFin during the drill?+
No. The tabletop exercise ends with the prepared report. Nothing is submitted.
What happens if the recovery fails?+
Then that is a finding. We agree abort criteria with your IT beforehand so that operations are not affected. Cause and action go on the list of deficiencies and into the report to the management body.
Read more
- DORA incident reporting: classifying and reporting ICT-related incidents
- Classifying critical or important functions under DORA
- DORA Article 16 transition: moving from BAIT to the simplified framework
- DORA gap analysis: quick check, Article 16 and full framework
- DORA Article 16: the simplified ICT risk management framework
- ICT risk management under DORA: framework and DOR strategy
- DORA scope: who does DORA apply to, and which framework?
- About us: DORA-Readiness by Blackfort Technology, Bonn
Sources
- Regulation (EU) 2022/2554 (DORA), Articles 5, 11, 12, 16, 19, 24 (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2024/1774 (ICT risk management), Articles 36, 39, 40 (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2025/301 (content and time limits of incident reports), Article 5 (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2024/1772 (classification of ICT-related incidents) (retrieved 2026-11-06)
- Section 1a German Banking Act (KWG), German (retrieved 2026-11-06)
- Section 65a German Banking Act (KWG), German (retrieved 2026-11-06)
- BaFin supervisory notice of 21 August 2025 on the simplified framework under Article 16 DORA, section 5 (PDF, German) (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).
Last updated: 2026-11-06
Get in touch
Discuss your drill
Tell us briefly which framework applies to your company, which function you would like to drill and who runs your IT. In the initial call, by phone or video, we discuss whether the drill fits. In the scoping call that follows we agree function, dates and participants.