Solutions · Financial services
Since January 2025, DORA has applied to financial entities across the EU. The first wave is done; now the German Federal Financial Supervisory Authority (BaFin) asks about processes in practice and complete registers. Sightadel guides you through the requirements, makes the register of information a by-product of everyday vendor management and records what the management body has decided.
Starting point
Most institutions started DORA as a project: gap analysis, revising policies, filling the register for the first reference date. Much of this now sits in spreadsheets, shared drive folders and emails. That was enough for the first submission. It is rarely enough for ongoing operations, because every contract change, every new service provider and every test has to be added somewhere.
DORA requires more than a register. The regulation rests on five pillars: ICT risk management with responsibility of the management body, handling and reporting of ICT-related incidents, digital operational resilience testing, management of ICT third-party risk and voluntary sharing of threat information. Technical standards from the European supervisory authorities set out the details. In Germany, BaFin is the supervisor.
Smaller firms face the same obligation with fewer staff. Information security often rests with one person who also looks after outsourcing, data protection and business continuity on the side. For them, what matters most is that evidence is in one place, deadlines are not forgotten and the next audit does not trigger a scramble to collect everything.
Why now
BaFin requests the register of information once a year for a reference date. Missing identifiers or contradictory entries lead to rejections. If you only update the register shortly beforehand, you start searching from scratch every year.
Statutory auditors and the supervisor ask about the ICT risk management framework, its annual review, test results and how findings are worked through. They want dated evidence, not declarations of intent.
Before the contract is signed, a risk assessment and a review of the contract terms are due. If the provider supports a critical or important function, an exit strategy and extended clauses are added.
A major incident triggers reporting deadlines of just a few hours. If you only settle classification criteria, responsibilities and reporting channels when it happens, you lose exactly those hours.
Penetration tests, vulnerability scans and internal audit produce findings. The supervisor wants to see that they are assessed, prioritised and worked through on time.
With an extended licence, a merger or the loss of exemptions, the simplified framework may no longer apply. Then the full requirements apply, and the evidence has to grow with them.
Relevant frameworks
Summarised in our own words, not legal advice. The original text in its current version is authoritative.
Has applied directly to financial entities in the EU since 17 January 2025, such as credit institutions, payment and e-money institutions, investment firms, insurers, asset management companies and crypto-asset service providers. There is no certificate. What is expected is a state of evidence that BaFin and auditors can follow.
View framework →Not mandatory, but the proven foundation. An ISMS builds risk management, access and change management, backups and incident handling anyway. DORA mainly adds the register of information, incident classification, contract terms and the testing programme.
View framework →Customer data, account data and credit information are sensitive. Data processing agreements and the register under DORA draw on the same service provider data. One incident can trigger a report to both the data protection authority and BaFin.
View framework →For financial entities within the scope of DORA, DORA is the more specific regulation. You meet your cyber security obligations there. NIS2 becomes relevant if companies in the group, such as an in-house IT service provider, operate outside DORA and reach the thresholds.
View framework →Not a topic for the institution itself, but valuable evidence when assessing cloud service providers. A current C5 attestation does not replace your own risk assessment, but makes it considerably more robust.
View framework →Recommended order
Clarify which type of financial entity you are under DORA and whether the simplified ICT risk management framework under Art. 16 could apply. This determines how extensive the framework, tests and documentation need to be.
Which functions would endanger business operations, the fulfilment of obligations or the licence if they failed? This decision carries through the register, contracts, tests and exit strategies. The management body adopts it.
Each ICT service provider is recorded with its contract, supported functions, data processing locations, subcontractors and evidence. This forms the register of information. Missing contract terms become measures for the next contract round.
Classification criteria, responsibilities, deputies and reporting channels are documented in advance and rehearsed once. An incident register also records incidents that are not reportable.
The requirements are worked through in a guided way, and existing evidence from the ISMS is assigned. The testing programme runs as a cycle. Findings become issues with a deadline and an owner.
The framework is reviewed at least once a year and after major incidents. The management body is informed, approves changes and keeps up its training. Sightadel reminds you of every due date.
Focus
Hardly any institution runs its IT alone. Core banking system, data centre, cloud, payments and specialist applications come from third parties. DORA makes these dependencies the core of supervision.
Not a simple list of contracts, but a structured collection: service provider, contract, function, criticality, locations, substitutability and the subcontractors behind them. In Sightadel it grows out of ongoing maintenance in the Vendors module, not out of a scramble before the reference date.
Contracts for ICT services need minimum content, such as a service description, data processing locations, access and audit rights, support with incidents and termination rights. Extended requirements apply to critical or important functions. Every missing clause becomes a task with an owner.
The risk is assessed before the contract is signed and reviewed regularly afterwards. Certificates, attestations and audit reports from providers are stored with their validity date under the respective vendor. When evidence expires, you see it on the dashboard.
Providers supporting critical or important functions need a documented plan for how the service can be replaced or brought back in-house without disruption. It is versioned like any other evidence and reviewed regularly.
How Sightadel helps
The Vendors module is the basis of the register of information. Service providers, contracts, supported functions, criticality, subcontractors and evidence are maintained there as soon as a contract is created or changes.
Learn more →The requirements of the regulation are stored with article references and expected evidence. Existing evidence from the ISMS is linked to DORA and ISO 27001 at the same time.
Learn more →Missing contract clauses, findings from tests and internal audit, and open points from the gap analysis become tasks with a deadline and an owner. Progress is visible at all times.
Learn more →Policies, management body resolutions, test logs and training records are kept versioned in one place. Every piece of evidence carries an expiry date; Sightadel reminds you before the deadline.
Learn more →Templates for the ICT risk management framework, the third-party risk policy, contingency plans and exit strategies provide a draft. You decide on risk appetite, critical functions and classification.
Learn more →Effort and duration
The ranges are based on experience, not a promise. The pace is usually set by how complete the contract records are and how willing providers are to renegotiate clauses. If you are designated for threat-led penetration testing, plan it as a separate project.
What you license · typically Professional
A typical institution runs DORA together with ISO 27001 as its foundation in the Professional edition. It includes ten users and 25 vendors. With many ICT service providers or several companies, Enterprise with an unlimited number of vendors is the right choice. If ISO 27001 is included, there is a permanent discount on DORA.
Licence per framework, minimum term one year, payable monthly or annually. You will find all prices, discounts and a calculator on the pricing page. Fees of a certification or audit body are charged separately.
Questions and answers
More in our FAQ or directly via our contact form.
Art. 16 DORA provides a simplified framework for certain smaller financial entities, for example small and non-interconnected investment firms, payment and e-money institutions exempted under EU law, and small institutions for occupational retirement provision. The requirements there are leaner, but they do not disappear. Whether you qualify follows from your licence. If in doubt, clarify this with your regulatory advisers.
No, but it helps considerably. Many foundations are in place. Typically missing are the register of information, the classification of incidents according to the criteria of the technical standards, the minimum content of contracts with ICT service providers and a testing programme as defined by DORA. In Sightadel you see which evidence is already linked to both frameworks.
Sightadel is not connected to BaFin's reporting platform. You maintain the register data in the Vendors module and export it. Submission in the required format and time window takes place via BaFin's platform.
Document the status, the discussions and your risk assessment. For functions that are not critical or important, the risk is often acceptable. For critical or important functions, the question belongs before the management body, including the exit strategy. Sightadel records the decision, the reasoning and the follow-up date.
Usually information security as Admin, outsourcing management, procurement and IT operations as Contributor, and the management body as Viewer. External auditors get the Auditor role: read, comment, edit after approval – never delete. Internal audit follows along as Viewer. You invite your external advisers as Consultant.
Correct, and that is why Sightadel belongs in your register. Sightadel is operated in Germany. We conclude a data processing agreement under Art. 28 GDPR with every customer.
Sightadel ensures that the framework, resolutions, tests, register and findings are evidenced with a date and an owner, and that auditors get their own access. Sightadel does not replace regulatory advice. For difficult questions, you can add a consulting package in the app if needed.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
