1 min Reading Time<\/p>\n
DORA has been fully applicable since January 17, 2025. After the first few months, it is clear: The technical requirements for ICT risk management, testing, and third-party control are complex – but the biggest bottleneck is often not the technology, but governance and third-party contracts.<\/strong><\/p>\n 1. ICT Risk Management:<\/strong> Comprehensive framework with risk policy, asset inventory, protective measures, and monitoring. Not just documented, but lived and regularly tested.<\/p>\n 2. ICT Incident Reporting:<\/strong> Significant incidents must be reported to the competent authority within 4 hours (initial warning), 24 hours (interim report), and 1 month (final report). Clear classification criteria for “significant” are mandatory.<\/p>\n 3. Digital Operational Resilience Testing:<\/strong> Annual ICT test programs, with additional Threat-Led Penetration Testing (TLPT) every 3 years for significant institutions, conducted by certified external testers.<\/p>\n 4. ICT Third-Party Management:<\/strong> Register of all critical ICT service providers, risk classification, contract clauses (audit rights, exit plans, subcontracting), concentration risk analysis.<\/p>\n 5. Information Sharing:<\/strong> Voluntary exchange of cyber threat information within the financial industry – institutionalized through DORA.<\/p>\n Third-Party Contract Adjustments:<\/strong> Thousands of existing contracts with ICT service providers must include DORA clauses. Many providers resist audit rights or do not accept DORA-compliant subcontracting regulations. This is time-consuming and ties up significant legal and procurement resources.<\/p>\n Criticality Assessment:<\/strong> Which ICT service providers are “critical”? The DORA criteria are clear, but their application in practice is less so. Many institutions have identified 50+ critical service providers – setting up a complete DORA-compliant monitoring system for each exceeds their capacities.<\/p>\n TLPT Preparation:<\/strong> Threat-Led Penetration Testing is more complex than classic penetration tests. It requires threat intelligence about the specific threat profile of the institution, a certified external tester (TIBER-EU Framework), and months of preparation.<\/p>\n Companies that are already NIS2-compliant have a significant advantage: ICT risk management framework, incident response processes, and third-party monitoring are already in place. DORA requires more granularity and more specific testing requirements, but the foundation is there.<\/p>\n What works well: The incident reporting chains are clearer than under NIS2 alone – banks have years of experience with reporting obligations to BaFin and EBA. The 4-hour initial reporting deadline is demanding, but technically achievable with well-configured SIEM and on-call processes.<\/p>\n DORA Application Date:<\/strong> January 17, 2025<\/p>\n Betroffene Institute:<\/strong> Over 22,000 financial companies in the EU<\/p>\n Initial Reporting SLA:<\/strong> 4 hours for significant ICT incidents<\/p>\n TLPT Requirement:<\/strong> Every 3 years for systemically important institutions (TIBER-EU Framework)<\/p>\n Penalties:<\/strong> Up to 1% of daily global revenue<\/p>\n Fact:<\/strong> Through DORA, over 22,000 financial institutions and their critical ICT service providers across the EU are required to conduct digital resilience tests – a regulatory first.<\/p>\n Fact:<\/strong> The BaFin reports that 38% of the institutions examined in the first DORA readiness check showed deficiencies in their ICT risk management frameworks.<\/p>\n Every question is locked. A tap unlocks the answer.<\/p>\n All EU-regulated financial companies: banks, insurance companies, investment firms, payment service providers, crypto-asset service providers, and critical ICT third-party service providers in the financial industry.<\/p>\n<\/details>\n NIS2 is a horizontal regulation for many sectors. DORA is sector-specific for finance and goes further in several areas: more specific testing requirements, stricter third-party management, and more direct supervision of critical ICT third-party service providers by ESAs.<\/p>\n<\/details>\n Providers whose failure could have a systemic impact on the financial sector. Critical ICT third-party service providers are directly supervised by ESAs (EBA, EIOPA, ESMA) – with their own inspection rights and penalty authority.<\/p>\n<\/details>\n Exit clauses, audit rights (including for sub-service providers), service level agreements for business continuity, data access rights in the event of insolvency, clauses on subcontracting and concentration risk disclosure.<\/p>\n<\/details>\n TIBER-EU (Threat Intelligence-based Ethical Red Teaming) is the European framework for Threat-Led Penetration Testing. DORA makes TLPT according to TIBER-EU guidelines mandatory for significant institutions – thus turning TIBER-EU from a voluntary framework into a regulatory requirement.<\/p>\n<\/details>\n \u2192 DORA: More IT and Legal Security in the Financial Sector<\/p>\n \u2192 NIS2 Checklist 2026<\/a><\/p>\n FinTech & Regulation: mybusinessfuture.com<\/a><\/p>\n Security for the Financial Sector: digital-chiefs.de<\/a><\/p>\n More from the MBF Media Network<\/p>\nTL;DR<\/h2>\n
\n
The 5 DORA Pillars in Overview<\/h2>\n
First Practical Experiences: What is More Challenging Than Expected<\/h2>\n
What Works Well – and What NIS2 Companies Can Do<\/h2>\n
Key Facts at a Glance<\/h2>\n
Frequently Asked Questions<\/h2>\n
Who does DORA apply to?<\/strong><\/summary>\n
What is the difference between DORA and NIS2?<\/strong><\/summary>\n
What is a critical ICT third-party service provider under DORA?<\/strong><\/summary>\n
What are the most important DORA contract clauses?<\/strong><\/summary>\n
How does DORA relate to TIBER-EU?<\/strong><\/summary>\n
Further Articles on the Topic<\/h2>\n
Further Reading in the Network<\/h2>\n
Related Articles<\/h2>\n
\n