DORA Consulting
For financial entities and their ICT service providers, we implement DORA in a practical way: ICT risk management, incident reporting, management of third-party risk and preparation for threat-led penetration testing (TLPT). We connect the supervisory perspective with technical reality so that compliance and operations fit together.
What DORA is and who it applies to
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied directly throughout the EU since January 17, 2025, without a national implementing act. It covers almost the entire financial sector: banks, insurers, payment and e-money institutions, investment firms, fund management companies and others, plus the ICT third-party service providers that work for them. In Germany, supervision lies with BaFin and the Bundesbank; for entities subject to DORA, BaFin’s former IT circulars (BAIT, VAIT, KAIT, ZAIT) were repealed when DORA began to apply.
The core idea: a financial entity must not only prevent disruptions to its ICT but be able to demonstrably withstand them. That is digital operational resilience. Proportionality applies throughout: the requirements scale with size, risk profile and complexity, from the simplified ICT risk management framework for small entities (Art. 16) to the TLPT obligations that only affect a few significant entities designated by the supervisory authority. For financial entities, the DORA requirements take precedence over the NIS2 obligations as the more specific law.
The five pillars of DORA
DORA is divided into five blocks of requirements. The regulation names them in Article 1; they are set out in Chapters II to VI together with technical regulatory standards (RTS/ITS):
From gap analysis to TLPT
Our DORA consulting starts with a gap analysis against the regulation and the relevant RTS: where does your ICT risk management stand, do your classification and reporting processes hold up, is the register of information complete and maintainable, do your ICT contracts meet the mandatory clauses? We translate the gaps into a prioritized roadmap and implement it together, pragmatically and in the language of the supervisor.
For testing, we build your program under Chapter IV proportionately. For most entities that means regular, risk-oriented testing, no TLPT. If you are designated as a significant entity for TLPT, we take over your side of the test: threat profile and scenarios, selection and steering of the testing provider, support during the test and remediation of the findings. We deliberately do not carry out the test itself: TLPT belongs in the hands of specialized testers, and we remain your independent advisor.
DORA thinks from the adversary’s perspective, and so do we
DORA is the first financial regulation to anchor threat-led thinking: explicitly in TLPT, and in substance in risk management. This way of thinking benefits every financial entity, even without a TLPT obligation: anyone who aligns measures and tests with the techniques of real adversaries (Threat-Informed Defense) does not fulfill DORA as a paper exercise and is prepared in case the supervisory authority classifies them as significant one day.
Introducing Threat-Informed Defense is the ideal foundation for this. For TLPT: the threat profile provides exactly the actors and scenarios that a threat-led test later replays. Anyone who lives TID goes into the test without surprises. And for detection & response: detection and alerting are focused on the techniques your real adversaries use instead of logging everything. That makes incident handling efficient and makes timely classification and reporting under Chapter III feasible in the first place.
Talk to us now, not to the regulator later.
Frequently asked questions about DORA consulting
Does DORA apply to our organization?
If you are a supervised financial entity, from a bank or an insurer to a payment institution or a fund management company: very likely yes; the regulation lists the covered types of entities exhaustively in Article 2. ICT service providers of financial entities are also affected: contractually through their customers’ mandatory clauses, and critical providers additionally through direct EU oversight.
What is a TLPT, and do we have to do one?
A threat-led penetration test: an attack test following the TIBER logic in which real attack scenarios are run against critical live functions based on current threat intelligence. It is mandatory for financial entities that the supervisory authority classifies as significant, generally at least every three years. All others also have to test their resilience regularly, just without a TLPT obligation.
Do you carry out TLPT yourselves?
No, deliberately not. We take over the financial entity’s side: threat profile and threat intelligence input, scoping and scenarios, selection and steering of the testing provider, support during the test and remediation of the findings. The execution belongs in the hands of specialized testers designated for it. This separation keeps us independent, in the test as in the result.
We are a small financial entity. Does all of this apply to us too?
DORA applies, but proportionately: the requirements scale with size, risk profile and complexity (Art. 4 DORA). A simplified ICT risk management framework applies to certain small and non-interconnected entities (Art. 16), microenterprises are partly exempt, and TLPT only affects the significant entities designated by the supervisory authority anyway. We size the implementation accordingly: no group-wide program for a small firm.
What is the register of information?
A complete register of all contractual arrangements on ICT services, per entity and at group level, according to the prescribed technical standard. The supervisory authority requests it regularly. In practice, it is the litmus test of third-party management: anyone who cannot maintain their register does not know their dependencies.
How does DORA relate to NIS2?
DORA takes precedence: the central NIS2 obligations do not apply to financial entities because the regulation, as sector-specific law, takes priority; in Germany, this is set out explicitly in Section 28(6) BSIG. Group structures with companies inside and outside the financial sector therefore need a close look at which entity falls under which regime.
We already comply with BAIT/VAIT. Is that enough?
A good starting point, but not enough: DORA goes beyond the former circulars especially on third-party risk (register of information, mandatory clauses, exit strategies), on reporting deadlines and on threat-led testing. BaFin repealed VAIT, KAIT and ZAIT completely when DORA began to apply, and BAIT for all institutions subject to DORA. A gap analysis shows what specifically needs to be added.
Daniel Thomas Heessel was named CISO of the Year 2026 and, as the security lead of an international group of companies, brought supervisory requirements and technical reality together. Daniel is a certified ISO 27001 Senior Lead Auditor, CISSP, CISM and MITRE ATT&CK Defender.
Reviewed in August 2026 against Regulation (EU) 2022/2554 (EUR-Lex).