ECB Action Plan on AI Cyber Threats

The DORA scope of application covers 20 types of financial entities, from credit institutions and insurers to crypto-asset service providers and ICT third-party providers. We help you precisely determine your entity classification, assess third-party obligations, and build a proportionate compliance strategy.

DORA requires financial institutions to conduct regular internal ICT audits and prepares them for external supervisory reviews by BaFin and statutory auditors. We guide you through the full DORA audit cycle - from internal audit programs to supervisory examination readiness.

Successful DORA compliance verification requires systematic preparation, documented evidence, and, for identified financial entities, TIBER-EU-aligned Threat-Led Penetration Tests (TLPT). We guide you through every phase: from gap assessment and audit readiness to BaFin/ECB-compliant TLPT execution.

From gap analysis to audit support. DORA has been mandatory since 17 January 2025, and BaFin is acting: over 600 reported ICT incidents, ongoing §44 special audits, and in Q3 2025 the first DORA fine proceedings due to inadequate ICT third-party documentation. The new IDW audit standard EPS 528 defines how statutory auditors will assess your DORA compliance. We make your organization audit-ready, across all five DORA pillars, based on our ISO 27001-certified methodology and years of BAIT/MaRisk experience in the financial sector.

Our DORA Compliance Checklist guides financial entities through all five DORA pillars, from initial gap analysis and self-assessment through to BaFin-aligned documentation and continuous monitoring.

Choosing the right DORA compliance software is critical for audit-proof implementation. We support financial institutions in evaluating, selecting, and integrating GRC platforms that cover all five DORA pillars, from the ICT register to incident reporting and third-party risk management.

DORA requires financial entities to maintain comprehensive documentation of their digital operational resilience. We support you in building a complete documentation system - from ICT risk management policies to the supervisory information register.

DORA Article 5 makes the management body personally accountable for the ICT risk management framework, digital resilience strategy, and governance structures. We help financial institutions build DORA-compliant governance, from board-level oversight to the three lines model.

An existing ISO 27001 certification covers approximately 85% of DORA requirements, but the remaining gaps are critical: TLPT resilience testing, ICT third-party contract management, and the Register of Information go beyond ISO 27001. We build precise control mappings, identify your specific DORA gaps, and design an integrated compliance framework that connects both standards efficiently.

Full DORA implementation requires more than documentation, it demands operational execution across all five pillars. We guide you from gap analysis through phased delivery to BaFin audit readiness.