Transition to DORA · full framework, holdings under Article 16
Transition from VAIT to DORA: move your documentation, align it with MaGo
Insurance and reinsurance undertakings under Solvency II have applied the DORA full framework since 17 January 2025. BaFin repealed VAIT, its former IT circular for insurers, with effect from the end of 16 January 2025. Many policies, roles and contingency documents still follow the VAIT structure. With our “Transition from VAIT” package we move this documentation to DORA and RTS 2024/1774, align it with MaGo, rehearse recovery and reporting and hand over the evidence. From €29,400 net plus VAT for the base scope described below, from €28,700 net for insurance holdings under the simplified framework.
Why a transition if DORA already applies?
This service covers the full framework: insurers under Solvency II have applied Articles 5-15 DORA since 17 January 2025, with no transitional period. Insurance holding companies under Section 293(5) of the German Insurance Supervision Act (VAG) apply the simplified framework of Article 16. There is a separate variant for them further down. Small insurers within the meaning of Article 4 of the Solvency II Directive are wholly exempt from DORA, so the package is not meant for them.
Many insurers have had their register of information and the main DORA policies in place since early 2025. Underneath, however, there is often documentation still built along VAIT lines: policies in the old chapter order, an information security officer without a clear line to the ICT risk control function, an IT contingency concept next to the contingency planning under MaGo, an outsourcing list that has never been reconciled with the register. The package is a clean-up of this existing documentation. We move it into the DORA framework, keep what works and close the points where VAIT structure, MaGo and DORA diverge. How the VAIT chapters map to DORA and how MaGo and DORA interact is explained on our page on VAIT and DORA for insurers (in German).
What does the “Transition from VAIT” package include?
Eight building blocks that build on each other. Article references without a suffix refer to DORA, “RTS” to Commission Delegated Regulation (EU) 2024/1774, Title II. MaGo is BaFin’s circular 09/2025 (VA) on the system of governance of Solvency II insurers.
What do we already have?
Inventory of VAIT and MaGo documents
We map every existing document to the relevant DORA or RTS provision, using BaFin’s comparison of 8 July 2024 as a guide. Together we decide: keep, rework or merge. Where VAIT had a requirement that DORA no longer expressly provides for, we clarify which task remains.
VAIT chapters and DORA (German)Is the framework based on DORA?
Framework, DOR strategy and policies
ICT risk management framework under Article 6, digital operational resilience strategy under Article 6(8) as a draft or a review of the existing one, policies and procedures structured along RTS Title II. Where possible we rework your own texts.
ICT risk management in the full framework (German)Who is responsible?
Roles and ICT risk control function
Duties of the management body (Article 5(2)), ICT risk control function with an appropriate level of independence (Article 6(4)), monitoring of ICT contracts (Article 5(3)). We clarify with you how the information security officer, the key function for IT security under MaGo and the control function fit together, and prepare the board resolution.
What is critical?
Function list with BIA
Critical or important functions under Article 3(22) with reasons and supporting systems and providers, business impact analysis under Article 11(5) and recovery objectives per function under Article 12(6). We keep this classification separate from the question whether an important function within the meaning of the VAG is outsourced.
Classifying functions (German)Which contingency plan applies?
Aligning contingency management
Contingency planning under MaGo chapter 14 stays the umbrella, and the ICT business continuity policy under Article 11(1) becomes part of it. One shared BIA, ICT response and recovery plans replacing the old IT contingency plans, a crisis management function (Article 11(7)) and a joint exercise and test plan.
Outsourcing or ICT service?
Outsourcing and ICT third parties
Outsourcing under MaGo chapter 13 and ICT contracts under Articles 28-30 apply in parallel. We reconcile the outsourcing list with the register of information, tag each arrangement and compare up to ten providers with the contract terms of Article 30(2) and (3) on the subject matter.
Managing ICT third parties (German)Does it work when it matters?
Recovery and reporting exercise
A recovery exercise for one critical or important function as part of the annual tests under Article 11(6), and a reporting exercise as a tabletop up to the initial notification, within 4 hours of classification as major and no later than 24 hours after becoming aware. We do not plan on the weekend and holiday relief, because it does not apply to every financial entity. Deficiencies go to the board with a report.
DORA incident reporting (German)Where is the evidence?
Evidence matrix and annual calendar
Every requirement of the full framework with evidence, owner and storage location. Plus a calendar of recurring duties, for example the review of the framework at least once a year (Article 6(5)), annual tests of the plans (Article 11(6)) and of systems supporting critical or important functions (Article 24(6)), assessment of legacy systems (Article 8(7)), training of the management body (Article 5(4)) and the annual submission of the register of information.
What you have at the end
We hand over the results as drafts for your undertaking to adopt and as an organised evidence file.
01
Mapping of your documentation
Every VAIT-era document with a decision (keep, rework, merge) and the relevant DORA or RTS provision.
02
Framework, DOR strategy, policies and procedures
Up to twelve documents as drafts, structured along RTS Title II, with an old-to-new map.
03
Role model with draft resolution
ICT risk control function, information security officer, monitoring of ICT contracts and outsourcing officer with tasks, boundaries and a draft resolution for the board.
04
Function list, BIA and recovery objectives
Critical or important functions with reasons, one BIA for MaGo contingency planning and ICT business continuity, recovery time and recovery point per function.
05
Reconciled provider list
Outsourcing list and register of information reconciled, every arrangement tagged, Article 30 comparison on the subject matter for up to ten providers.
06
Exercise records, evidence matrix, annual calendar
Record of the recovery exercise, evaluation of the reporting exercise with deficiencies and actions, evidence matrix and calendar of recurring duties.
Example: timeline at a mid-sized insurer
Fictitious example, not a client: a property and casualty insurer with just over 300 employees, register of information and reporting process running since 2025, policies and contingency concept still in VAIT structure. Start in January 2027. Not a promise of timing: board dates, holiday periods and the availability of the data centre provider shift the plan.
| Period | Phase | Result | Resolution |
|---|---|---|---|
| January to February 2027 | Inventory and mapping | 54 documents mapped, draft function list and shared BIA, differences between outsourcing list and register recorded | none |
| March 2027 | Framework, strategy and roles | Framework, DOR strategy with a reference to the IT strategy, role model with control function | board meeting in March |
| April to May 2027 | Policies, procedures and MaGo alignment | ten policies and procedures reworked, ICT business continuity policy within contingency planning, Article 30 comparison for eight providers | adoption by the responsible board member |
| June 2027 | Exercises and handover | recovery exercise for the policy administration system, reporting exercise, evidence matrix, annual calendar | report to the board |
Example by Blackfort Technology, no commitment to dates or results.
What does the transition from VAIT cost, and where are the limits?
From €29,400 net for the base scope under the full framework, from €28,700 net for the insurance holding variant. Calculated at €1,400 net per person-day (PD), the table shows the effort per component. We price additional legal entities, documents, workshops or providers after the scoping call.
| Component | Insurer (full framework) | PD | Insurance holding (Article 16) | PD |
|---|---|---|---|---|
| Legal entities | one | - | one | - |
| Inventory and mapping | up to 60 documents | 3 | up to 60 documents | 3 |
| Framework, policies and procedures | up to 12 drafts, including a draft or review of the DOR strategy | 6 | information security policy under RTS Article 29 and procedures under RTS Title III, up to 12 drafts | 6 |
| Roles and governance with draft resolutions | role model with ICT risk control function (Article 6(4)) and monitoring of ICT contracts | 1.5 | roles and independence under RTS Article 28 | 1 |
| Function list, BIA, recovery objectives, ICT providers | up to 10 providers in the function list and Article 30 comparison | 3 | up to 10 providers in the function list and Article 30 comparison | 3 |
| Alignment with MaGo | contingency management (chapter 14) and outsourcing (chapter 13) | 1.5 | insofar as MaGo applies to the holding | 1.5 |
| Recovery and reporting exercise | one each: recovery of one critical or important function (planning, support and record by us, carried out by your IT or your provider), reporting exercise as a tabletop of up to 3 hours | 2 | one each, as on the left | 2 |
| Evidence matrix, annual calendar, handover | evidence matrix, annual calendar | 1.5 | evidence matrix, template for the review report (RTS Article 41), annual calendar | 1.5 |
| Project management and workshops | up to 8 workshops of up to 3 hours each, 2 of them with the board, by video or on site | 2.5 | up to 8 workshops, 2 of them with the management body | 2.5 |
| Total | 21 | 20.5 | ||
| Price (€1,400 per PD) | from €29,400 net plus VAT | from €28,700 net plus VAT |
Offered to businesses only (B2B). PD = person-day. We price additional legal entities, such as further companies in a group, and additional documents, workshops or providers after the scoping call and state the price in our proposal. A previously commissioned full framework gap analysis (for holdings the Article 16 gap analysis) is credited, with details in the proposal.
How does the transition work?
Four phases. How long they take depends mainly on how quickly documents, meetings and board resolutions come together.
1
Inventory and mapping
Collect and map documents, draft the function list and BIA, put the outsourcing list and the register side by side.
2
Framework, strategy and roles
Framework and DOR strategy, role model with control function, board resolution on roles, function list and BIA.
3
Policies, procedures and MaGo alignment
Rework policies and procedures, fit ICT business continuity into contingency planning, tag providers and compare them with Article 30.
4
Exercises and handover
Recovery and reporting exercise, evaluation, evidence matrix and annual calendar, closing session with the board.
The DORA duties have applied since 17 January 2025, and a project plan postpones none of them. It sets what comes first. For insurers that is usually the roles and the shared BIA, because contingency planning and provider management build on them.
Your contact
Christian Gebhardt · Founder and Managing Director, Blackfort Technology
Your contact is Christian Gebhardt, Founder and Managing Director. Who works on the project is set out in our proposal.
We usually reply to your enquiry within 1-2 working days.
Transition package, explainer page or gap analysis?
Our page on VAIT and DORA for insurers (in German) explains where the VAIT chapters have gone, how MaGo and DORA interact and what a rebuild plan looks like. If you want to do the work yourself, that is your starting point. With the package we do it together with you and hand over the results.
The full framework gap analysis is an analysis with an action plan: it shows where you stand and leaves open who implements. If you do not know how much VAIT legacy there is in your undertaking, start with the analysis. If you then commission the package, the gap analysis is credited, with details in the proposal. If you already know the scope, start directly with the package, which includes the inventory.
Variant for insurance holdings
Insurance holding companies under Section 7 No. 31 VAG and undertakings under Section 293(4) VAG whose main business is acquiring and holding participations in insurers or pension funds and which are not yet supervised under the VAG apply DORA, but the simplified framework of Article 16 instead of Articles 5-15 (Section 293(5) VAG). The VAG does not provide a transitional period for this.
For them we offer a variant with the same scope, aligned with Article 16 and RTS Title III: policy and procedures, roles, function list with BIA, exercises and evidence handover, from €28,700 net. It fits when the holding has taken over group policies from the VAIT era and wants to align them with the simplified framework. Our Article 16 page (in German) explains what Article 16 requires in detail.
Who the package is not meant for
Small insurers within the meaning of Article 4 of the Solvency II Directive are outside DORA. BaFin points out that supervised undertakings outside DORA still have to deal appropriately with ICT and cyber risks as part of a proper business organisation. This package is too large for that.
The MaGo for Solvency II insurers does not apply to burial funds (Sterbekassen), Pensionskassen and small insurance undertakings under Section 211 VAG. Whether and under which framework DORA applies to your undertaking we clarify with you first, using our applicability page (in German). Alignment with the MaGo for Solvency II insurers is then not part of the package.
Who is responsible for the package
The responsible consultant is Christian Gebhardt, founder and managing director of Blackfort Technology. We know the questions of the insurance sector from the DORA programme of a large German insurance group (on behalf of an international management consultancy, 02/2024-10/2025). We do not name clients.
What does your undertaking contribute?
A contact person
For example the ICT risk control function, the information security officer or IT governance, with about one day per week for coordination, documents and review of drafts.
The board
Two workshop dates and the resolutions on roles, strategy, function list and BIA. Responsibility for the framework stays with the management body (Article 5(2) DORA).
Contingency, outsourcing, IT
The people responsible for contingency planning and outsourcing in the workshops, information on systems and contracts, and IT or the provider carrying out the recovery exercise.
What is not part of the package?
To set expectations:
- No technical implementation. Your IT or your providers set up network security, logging or vulnerability management. We describe the requirement and review the evidence. Technical implementation with us is agreed separately.
- No legal advice, no contract negotiation and no legal contract review. The comparison with Article 30 DORA is on the subject matter. Whether an arrangement is outsourcing under Section 32 VAG and how clauses are worded is a matter for your legal counsel. Building and submitting the register of information is not part of the package.
- No assumption of roles. We take on the ICT risk control function, the information security officer, the outsourcing officer or internal audit only under a separate engagement.
- No commitment as to how supervisors, statutory auditors or internal audit will assess the result. No certificate.
The assessments on this page are general information on DORA, RTS 2024/1774, VAG and MaGo as of 6 November 2026. Whether and how they apply to your undertaking has to be checked case by case.
Frequently asked questions
DORA has applied since January 2025. Are we behind if we still have VAIT documents?+
That cannot be said in general. Many insurers implemented the DORA duties in 2025 and kept using VAIT-era documents, often for good reason. The package puts this documentation in order and closes the points where VAIT structure, MaGo and DORA diverge. The inventory, or a gap analysis beforehand, shows where you stand.
Do we have to abolish our information security officer?+
No. The tasks remain even though DORA does not name the role, and MaGo names IT security as a possible key function. In the “Roles and ICT risk control function” block we agree with you how the information security officer and the control function relate.
Is the gap analysis credited?+
Yes. A previously commissioned full framework gap analysis is credited against the package, for insurance holdings the Article 16 gap analysis. Details are in the proposal.
We are part of an insurance group. Can this cover several companies?+
Yes. The base scope covers one legal entity. For further companies we agree in the scoping call what is handled jointly and what is produced per company, and we state the price in the proposal.
What happens after the handover?+
You run the framework yourself, with the annual calendar as a guide. If you wish, we support the next annual review or the next exercise. We agree that separately.
Read more
- VAIT and DORA for insurers: mapping, MaGo and transition plan
- ICT risk management under DORA: framework and DOR strategy
- DORA gap analysis: quick check, Article 16 and full framework
- Classifying critical or important functions under DORA
- ICT third-party risk under DORA: managing providers and Article 30 contracts
- DORA incident reporting: classifying and reporting ICT-related incidents
- DORA register of information: structure, mandatory fields, submission
- DORA Article 16: the simplified ICT risk management framework
- DORA Article 16 transition: moving from BAIT to the simplified framework
- DORA scope: who does DORA apply to, and which framework?
- About us: DORA-Readiness by Blackfort Technology, Bonn
Sources
- Regulation (EU) 2022/2554 (DORA), Articles 2, 3, 5, 6, 8, 11, 12, 16, 24, 28-30 (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2024/1774 (ICT risk management, Titles II and III) (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2025/301 (content and time limits of incident reports) (retrieved 2026-11-06)
- BaFin news of 9 January 2025 on the repeal of KAIT, VAIT and ZAIT (German) (retrieved 2026-11-06)
- BaFin supervisory notice of 8 July 2024 (as of June 2024) on implementing DORA in ICT risk management and ICT third-party risk management (PDF, German) (retrieved 2026-11-06)
- BaFin supervisory notice of 21 August 2025 on the simplified framework under Article 16 DORA (PDF, German) (retrieved 2026-11-06)
- BaFin circular 09/2025 (VA) MaGo for Solvency II insurers of 14 July 2025 (German) (retrieved 2026-11-06)
- BaFin article of 14 July 2025 on the updated MaGo circular (German) (retrieved 2026-11-06)
- German Insurance Supervision Act (VAG), Section 293(4) and (5), unofficial version (German) (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).
Last updated: 2026-11-06
Get in touch
Discuss your transition
Tell us briefly which lines of business you write, how many employees you have, which documents date from the VAIT era and who runs your data centre. In the initial call, by phone or video, we check whether the package fits. In the scoping call that follows we set scope, price and start date.