Last updated: 2026-11-06
The obligations matrix on this page assigns each DORA requirement to the framework in which it applies. It is a map for implementation. Each obligation is explained on the page linked in its row. Which framework applies to you is covered on our page DORA applicability. How the regulation is structured and which sources from BaFin, the German financial supervisor, matter is shown in our overview of the DORA Regulation.
How to read the matrix
- Full framework gives the provision for financial entities applying Articles 5-15, Article 16 the provision under the simplified framework. “RTS” means Delegated Regulation (EU) 2024/1774, Title II for the full framework and Title III for Article 16.
- No explicit requirement means the regulation does not expressly require this element under this framework. It is not a recommendation to abolish an existing role, document or safeguard.
- (M) marks relief for microenterprises under Article 3(60): fewer than ten employees and annual turnover and/or annual balance sheet total not exceeding EUR 2 million. Check the status with both figures, it should never be assumed (applicability).
- (KWG-M) marks obligations that do not apply to microenterprises of the KWG group, because Section 1a(2a) sentence 2 no. 3 of the German Banking Act (KWG) exempts them from Articles 28-30.
- Start: “2025” means applicable since 17 January 2025. For institutions under Section 1a(2a) KWG (the KWG group, such as factoring, finance leasing and guarantee banks), incident reporting has also applied since 17 January 2025, everything else from 1 January 2027 (“KWG 2027”).
Obligations matrix: DORA requirements by framework
1. Governance and ICT risk management framework
| Obligation | Full framework | Article 16 | Start | Details |
|---|---|---|---|---|
| Management body is responsible for ICT risk management | Article 5(2) | RTS Article 28(2) | 2025, KWG 2027 | ICT risk management, Article 16 |
| ICT knowledge of the management body, regular training | Article 5(4) | no explicit requirement, but training for staff and management (Article 16(1)(h)) | 2025, KWG 2027 | Article 16 |
| Role or member of senior management to monitor ICT third-party arrangements | Article 5(3) (M) | no explicit requirement | 2025 | ICT third-party service providers |
| Documented ICT risk management framework | Article 6(1) and (2) | Article 16(1)(a), RTS Article 28(1) | 2025, KWG 2027 | ICT risk management, Article 16 |
| Information security policy with security measures | Article 9(4), RTS Article 2 | RTS Article 29 | 2025, KWG 2027 | Article 16 |
| Digital operational resilience strategy | Article 6(8) | no explicit requirement | 2025 | ICT risk management |
| Independent ICT risk control function | Article 6(4) (M) | no separate function, but segregation and independence of control and internal audit functions (RTS Article 28(4)) | 2025, KWG 2027 | Article 16, roles |
| Internal audit of the framework | Article 6(6) (M) | RTS Article 28(5) and (6) | 2025, KWG 2027 | Article 16 |
| Review of the framework with report | Article 6(5), at least yearly (M: periodically), RTS Article 27 | Article 16(2), periodically and after major ICT-related incidents, RTS Article 41 | 2025, KWG 2027 | Article 16 |
| Identify and classify functions and assets, determine critical or important functions | Article 8(1) | RTS Article 30 | 2025, KWG 2027 | Critical or important functions |
| Risk assessment and risk tolerance | Article 6, Article 8(2) and (3) ((3): M) | RTS Article 31 | 2025, KWG 2027 | ICT risk management, Article 16 |
2. Protection, detection, business continuity
| Obligation | Full framework | Article 16 | Start | Details |
|---|---|---|---|---|
| Protection and prevention: access control, operations, data and network security, physical security | Article 9, RTS Title II Chapters I and II | RTS Articles 32 to 35 | 2025, KWG 2027 | ICT risk management, Article 16 |
| Identify vulnerabilities and apply patches | RTS Article 10 | RTS Article 34(d) (automated vulnerability scanning) | 2025, KWG 2027 | Article 16 |
| Logging | RTS Article 12 | RTS Articles 33 and 34(f) | 2025, KWG 2027 | Article 16 |
| Acquisition, development, project and change management | RTS Articles 15 to 17 | RTS Articles 37 and 38 | 2025, KWG 2027 | Article 16 |
| Detect anomalous activities, set alert thresholds | Article 10, RTS Article 23 | Article 16(1)(d), RTS Article 31(4) | 2025, KWG 2027 | ICT risk management |
| Business impact analysis | Article 11(5) | RTS Article 28(2)(d) | 2025, KWG 2027 | ICT risk management, Article 16 |
| Business continuity with recovery objectives | Article 11, Article 12(6) | Article 16(1)(f), RTS Article 39(2)(d) | 2025, KWG 2027 | ICT risk management, Article 16 |
| Backup and restoration | Article 12 ((4) redundant capacities: M) | RTS Article 39(2)(f) and (g) | 2025, KWG 2027 | Article 16 |
| Testing of business continuity plans, at least yearly | Article 11(6) | RTS Article 40 | 2025, KWG 2027 | Article 16 |
| Crisis management function | Article 11(7) (M) | no explicit requirement, escalation in the business continuity plan (RTS Article 39) | 2025 | Article 16 |
| Learning from tests and incidents, awareness and training for all staff | Article 13 | Article 16(1)(h) | 2025, KWG 2027 | ICT risk management |
| Communication plans and a designated person for communication | Article 14 | no explicit requirement | 2025 | ICT risk management |
3. ICT-related incidents
| Obligation | Full framework | Article 16 | Start | Details |
|---|---|---|---|---|
| Process for managing ICT-related incidents | Article 17 | Article 17 | 2025, KWG group too | Incident reporting |
| Classification under Delegated Regulation 2024/1772 | Article 18 | Article 18 | 2025, KWG group too | Incident reporting |
| Reporting of major ICT-related incidents in three stages (Delegated Regulation 2025/301, Implementing Regulation 2025/302) | Article 19(1) and (4) | Article 19(1) and (4) | 2025, KWG group too | Incident reporting |
| Informing clients of major ICT-related incidents | Article 19(3) | Article 19(3) | 2025, KWG group too | Incident reporting |
4. Digital operational resilience testing
| Obligation | Full framework | Article 16 | Start | Details |
|---|---|---|---|---|
| Testing programme with vulnerability scans and penetration tests | Articles 24 and 25 (M: risk-based under Article 25(3)) | plan for ICT security testing (RTS Article 36), Articles 24 and 25 as well on our reading | 2025, KWG 2027 | Article 16, reading on Articles 24 and 25 |
| Yearly testing of all systems supporting critical or important functions | Article 24(6) (M) | open whether applicable alongside RTS Article 36 | 2025, KWG 2027 | Article 16 |
| Threat-led penetration testing (TLPT), at least every three years | Articles 26 and 27, Delegated Regulation 2025/1190, only where designated by the authority (M: no) | does not apply | 2025 | - |
5. ICT third-party service providers
| Obligation | Full framework | Article 16 | Start | Details |
|---|---|---|---|---|
| Identify key dependencies on ICT third-party service providers | Article 8(5) | Article 16(1)(e), RTS Article 30(2), also for microenterprises of the KWG group | 2025, KWG 2027 | ICT third-party service providers |
| Full responsibility despite outsourcing | Article 28(1) | Article 28(1) (KWG-M) | 2025, KWG 2027 | ICT third-party service providers |
| Strategy on ICT third-party risk with contractual policy (Delegated Regulation 2024/1773) | Article 28(2) (M) | no explicit requirement | 2025 | ICT third-party service providers |
| Maintain the register of information and submit it yearly (Implementing Regulation 2024/2956) | Article 28(3) | Article 28(3) (KWG-M) | 2025, KWG 2027 | Register of information |
| Assessment before contracting: classification, risks, due diligence, conflicts of interest | Article 28(4) | Article 28(4) (KWG-M) | 2025, KWG 2027 | ICT third-party service providers |
| Termination rights for all ICT contracts, exit strategies for services supporting critical or important functions | Article 28(7) and (8) | Article 28(7) and (8) (KWG-M) | 2025, KWG 2027 | ICT third-party service providers |
| Assess concentration risk | Article 29 | Article 29 (KWG-M) | 2025, KWG 2027 | ICT third-party service providers |
| Contract content for all ICT contracts, additional content for critical or important functions | Article 30(2) and (3) | Article 30(2) and (3) (KWG-M) | 2025, KWG 2027 | ICT third-party service providers, the providers’ view: DORA for ICT service providers |
| Subcontracting of services supporting critical or important functions (Delegated Regulation 2025/532) | Article 30(2)(a) | Article 30(2)(a) (KWG-M) | RTS in force since 22 July 2025 by our calculation, KWG 2027 | ICT third-party service providers |
6. Information sharing
| Obligation | Full framework | Article 16 | Start | Details |
|---|---|---|---|---|
| Sharing of cyber threat information, voluntary, notify the authority of participation and its end | Article 45(1) and (3) | Article 45(1) and (3) | 2025, KWG 2027 | DORA Regulation |
The matrix abbreviates the wording of the provisions. For implementation, the text of the regulation and the Level 2 acts is what counts. What has to be evidenced in detail under Article 16 is shown in the evidence matrix on our page DORA Article 16.
Example: the matrix for a small fund management company
Fictitious example. Muster-KVG mbH has 42 employees, manages special AIFs and is licensed as a German fund management company (Kapitalverwaltungsgesellschaft, KVG). It falls under Article 2(1)(k) DORA. Under BaFin’s supervisory notice of 21 August 2025, Article 16 is not an option for former addressees of the KAIT (BaFin’s supervisory requirements for IT in fund management companies). The KAIT were repealed with effect from the end of 16 January 2025, while the KAMaRisk (Minimum Requirements for Risk Management of fund management companies) continues to apply. Management filters the matrix on the full framework column and strikes out only the microenterprise relief (M), because with 42 employees the firm is not a microenterprise. The extract shows the five rows it tackles first:
| Obligation | Provision | Status at Muster-KVG | Next step | Responsible |
|---|---|---|---|---|
| Digital operational resilience strategy | Article 6(8) | IT strategy from the KAIT era in place, without reference to DORA | add the objectives and implementation of the ICT risk management framework to the strategy | management |
| ICT risk control function | Article 6(4) | information security officer reports to the head of IT | ensure and document the independence of the control function from the head of IT | management |
| Testing of business continuity plans | Article 11(6) | contingency test 2025 only for the fund accounting system | extend the test plan to all systems supporting all functions, add a cyber-attack scenario | head of IT |
| Yearly testing of systems supporting critical or important functions | Article 24(6) | penetration test only for the investor portal | define the testing programme for all systems supporting critical or important functions | information security |
| Contract content | Article 30(2) and (3) | contract with the provider of the portfolio management system concluded before 2023 | compare the contract with Article 30, renegotiate missing content, have it reviewed legally | outsourcing management |
TLPT only comes into question for Muster-KVG if the authority designates it. It has checked the exemption in Article 2(3)(a) for managers referred to in Article 3(2) of the AIFM Directive and concluded that it does not apply. Classification in an individual case remains a matter for legal review.
DORA alongside other rules
DORA does not replace all other requirements. Some rules step back, others continue to apply alongside it. The table states the relationship in one sentence and points to the page that explains it.
| Rules | Relationship to DORA | Explained on |
|---|---|---|
| NIS2 and BSIG (German BSI Act) | For financial entities that are NIS2 entities, DORA is the sector-specific legal act and takes precedence in risk management and incident reporting. Which BSIG obligations Section 28(6) BSIG disapplies is set out on our page DORA applicability. | NIS2-Readiness: implementing NIS2 (in German) |
| BAIT (BaFin’s supervisory requirements for IT in banks) | no longer applicable to DORA entities since 17 January 2025, for the KWG group until the end of 31 December 2026 | BAIT and DORA |
| MaRisk (Minimum Requirements for Risk Management, Circular 06/2026 (BA)) | continues to apply alongside DORA, for example AT 7.3 emergency management and AT 9 for outsourcing outside Articles 28-30 | MaRisk and DORA |
| VAIT and MaGo | VAIT (IT requirements for insurers) repealed with effect from the end of 16 January 2025, the MaGo (Minimum Requirements for the System of Governance) for Solvency II insurers (Circular 09/2025 (VA)) continues to apply | DORA for insurers |
| KAIT, ZAIT, KAMaRisk | KAIT and ZAIT repealed with effect from the end of 16 January 2025, KAMaRisk continues to apply | - |
| C5 attestation (BSI) | audit report for cloud providers that financial clients draw on when managing their ICT service providers | C5-Readiness: C5 and DORA (in German) |
| Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (CRA) | horizontal cybersecurity requirements for products with digital elements, so a product view rather than operations at the financial entity | CRA-Readiness: CRA, NIS2 and DORA compared (in German) |
| ISO/IEC 27001 | in our assessment not a DORA obligation and no substitute for one. DORA governs incident reporting, the register of information and contract content in its own right, an existing ISMS provides building blocks | Implementing ISO 27001 (in German) |
| GDPR | applies alongside, with its own notification under Article 33 GDPR for incidents involving personal data | Incident reporting |
Three typical gaps when checking the obligations
| Gap | Cause | Effect | Remedy |
|---|---|---|---|
| Obligations list from the other framework | A checklist or template for the full framework is used under Article 16, or the other way round. | Effort goes into documents the framework does not expressly require, while the framework’s own obligations are missing, such as the review report under RTS Article 41 or the policy under RTS Article 29. | Filter the matrix on your own framework’s column and evidence each row with a reference in your own document set. |
| DORA treated as an IT project only | Implementation sits with IT alone, while procurement, outsourcing management and the legal department are not involved. | Articles 28-30 are left undone: contracts without the content required by Article 30, a register that does not list all ICT contracts, no exit strategies. | Assign every row of the matrix to a responsible unit, explicitly placing areas 5 and 6 outside IT. |
| Parallel rules not recorded | The assumption that DORA replaces all IT requirements of the supervisor. | Obligations from MaRisk, MaGo or KAMaRisk, such as the contingency plan or outsourcing rules, drop out of the control plan. | Add a column “sectoral obligation alongside” to your own matrix and check it against the section DORA alongside other rules. |
How we help
In our DORA gap analysis we lay this matrix over your documents and show for each row whether evidence exists and what comes first. KWG group institutions moving from the BAIT on 1 January 2027 will find the matching offer in our service for the transition from BAIT to Article 16. The mapping is general information. The legal assessment of an individual case remains with your legal counsel.
Frequently asked questions
Which DORA requirements apply to small institutions?+
That depends on the framework, size alone does not decide it. Article 16 only applies to the groups named in DORA or in German law. Microenterprises have some relief under the full framework, marked (M) in the matrix. Which case applies is covered on our page DORA applicability.
What does “no explicit requirement” mean in the matrix?+
That DORA does not expressly require this element under the framework concerned. The task behind it often remains, and sectoral rules such as the MaRisk may still require it. It does not follow that an existing role, document or safeguard should be abolished.
Is an ISO 27001 certificate enough to meet the DORA requirements?+
In our assessment, no. An ISMS under ISO/IEC 27001 covers many safeguards, but DORA governs obligations such as incident reporting, the register of information, contract content under Article 30 and testing under Articles 24 and 25 in its own right. A certificate does not replace any of these obligations.
Since when have the DORA requirements applied?+
For financial entities under Article 2 DORA, since 17 January 2025. For institutions under Section 1a(2a) KWG, incident reporting has also applied since 17 January 2025, the other obligations from 1 January 2027 (Section 65a(3) KWG). The dates in detail are set out in our overview of the DORA Regulation.
Read more
- DORA regulation (EU) 2022/2554: structure, dates, supervision
- DORA scope: who does DORA apply to, and which framework?
- DORA Article 16: the simplified ICT risk management framework
- ICT risk management under DORA: framework and DOR strategy
- ICT third-party risk under DORA: managing providers and Article 30 contracts
- DORA incident reporting: classifying and reporting ICT-related incidents
Sources
- Regulation (EU) 2022/2554 (DORA), German version, Article 3(60), Articles 5-30, 45 (retrieved 2026-11-06)
- Delegated Regulation (EU) 2024/1774 (RTS on ICT risk management), Titles II and III, German version (retrieved 2026-11-06)
- Delegated Regulation (EU) 2024/1772 (classification of incidents), German version (retrieved 2026-11-06)
- Delegated Regulation (EU) 2025/301 (content and time limits of incident reports), German version (retrieved 2026-11-06)
- Implementing Regulation (EU) 2025/302 (reporting templates), German version (retrieved 2026-11-06)
- Implementing Regulation (EU) 2024/2956 (register of information), German version (retrieved 2026-11-06)
- Delegated Regulation (EU) 2024/1773 (policy on ICT services), German version (retrieved 2026-11-06)
- Delegated Regulation (EU) 2025/532 (subcontracting), German version (retrieved 2026-11-06)
- Delegated Regulation (EU) 2025/1190 (TLPT), German version (retrieved 2026-11-06)
- Regulation (EU) 2024/2847 (CRA), title, German version (retrieved 2026-11-06)
- German Banking Act (KWG), Section 1a(2a) (unofficial version, in German) (retrieved 2026-11-06)
- German Banking Act (KWG), Section 65a(3) (unofficial version, in German) (retrieved 2026-11-06)
- German BSI Act (BSIG), Section 28(6) (unofficial version, in German) (retrieved 2026-11-06)
- BaFin: news of 9 January 2025 on changes to IT requirements under DORA, in German (retrieved 2026-11-06)
- BaFin: supervisory notice of 21 August 2025 on the simplified ICT risk management framework (Article 16 DORA), in German (retrieved 2026-11-06)
- BaFin: DORA FAQ 12 on DORA and NIS2, in German (retrieved 2026-11-06)
- BaFin: DORA FAQs (overview page), in German (retrieved 2026-11-06)
- BaFin: Circular 06/2026 (BA) MaRisk, as of 30 June 2026, in German (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).