ict-risikomanagement

/dora:ict-risikomanagement

Purpose

DORA is the central EU cyber resilience regulation for the financial sector. Existing BAIT/MaRisk structures are not automatically DORA-compliant — the obligations go deeper (in particular third-party register, TLPT, incident reporting). This skill provides the gap analysis + roadmap.

Inputs

• Type of financial entity (CRR institution, insurer, KAGB-KVG, crypto service provider, payment institution, etc.)
• Size classification (Art. 16: microenterprise vs. larger)
• Existing frameworks (BAIT, VAIT, KAIT, ZAIT, MaRisk)
• ICT third-party list
• Last penetration test

Procedure

1. Scope (Art. 2 DORA)

DORA applies in particular to:

• Credit institutions, payment and e-money institutions
• Investment firms, trading venues, central securities depositories
• Insurers and reinsurers, insurance intermediaries
• KAGB capital management companies
• Crypto service providers (CASP) since MiCA
• Crowdfunding service providers

2. Relationship to BAIT/MaRisk

• BAIT/VAIT/KAIT/ZAIT remain applicable, supplement DORA.
• Where there is a conflict: DORA takes precedence as directly applicable EU regulation.
• BaFin has published DORA interpretation notes; national concretization remains.

3. Governance (Art. 5)

• Management body bears ultimate responsibility for ICT risk management.
• Training of management is mandatory (Art. 5(4)).
• Strategy for digital operational resilience (Art. 6(8)).

4. ICT risk management framework (Art. 6)

Six pillars:

Pillar	Article	Content
Strategy and governance	Art. 5–6	Top-down, with budget
Identification	Art. 8	Inventory of ICT assets, business function significance
Protection / Prevention	Art. 9	Identity/access management, encryption, patching, backup
Detection	Art. 10	Monitoring, alerting, escalation
Response & Recovery	Art. 11–12	Business continuity plan, recovery time objective
Learning	Art. 13	Post-incident reviews, improvement measures

5. ICT incident management (Art. 17–23)

• Classification by severity (Art. 18) — RTS 2024/1772 defines thresholds
• Early warning within hours, initial report, final report
• Competent authority: BaFin

6. Tests (Art. 24–27)

• Regular tests at least annually (Art. 24, 25)
• Threat-Led Penetration Testing (TLPT) under Art. 26 DORA — for significant institutions every 3 years
• Tester accreditation under Art. 27 DORA

7. Third parties (Art. 28–30)

• Register of all ICT third-party arrangements
• Critical functions require minimum contractual content (Art. 30)
• BaFin / EBA reporting

8. Information Sharing (Art. 45)

Voluntary agreements on cyber threat information among financial undertakings.

Sources

Statute

• Regulation (EU) 2022/2554 (DORA) — full text
• RTS 2024/1772 (classification of incidents)
• BaFin interpretation notes on DORA

Interlinkage

• Regulation (EU) 2022/2555 (NIS2) — lex generalis in relation to DORA
• BAIT, VAIT, KAIT, ZAIT (BaFin)
• MaRisk (AT 7.2)

Secondary literature

• Linke, in: Hellner/Steuer, Bankrecht und Bankpraxis, DORA chapter
• BeckOK DORA (online)
• DORA commentary by Maume/Maute/Fromberger (in preparation)

Publication format

DORA IKT-RISIKOMANAGEMENT — Gap-Analyse — <Mandant> — <Datum>

I.    Geltungsbereich (Art. 2)        [Ja — Institutsklasse / Mikro nach Art. 16]
II.   Verhältnis zu BAIT/MaRisk       [bestehend / Gap-Liste]
III.  Säulen-Reife
      Governance Art. 5                [🟢 / 🟡 / 🔴]
      Identifikation Art. 8             [🟢 / 🟡 / 🔴]
      Schutz Art. 9                     [🟢 / 🟡 / 🔴]
      Erkennung Art. 10                 [🟢 / 🟡 / 🔴]
      Reaktion / Wiederherstellung Art. 11–12  [🟢 / 🟡 / 🔴]
      Lernen Art. 13                    [🟢 / 🟡 / 🔴]
IV.   Vorfallsmanagement (Art. 17–23)  [Reifegrad / Lücken]
V.    Tests / TLPT (Art. 24–27)         [Letzter / nächster Test]
VI.   Drittparteien-Register (Art. 28) [vollständig / unvollständig]

Roadmap:
  Q1: <…>
  Q2: <…>

Bußgeldrisiko: Bei wesentlichen Verstößen — bis 1 % des durchschnittlichen Tagesumsatzes pro Tag.

Risks / typical mistakes

• BAIT regarded as a substitute for DORA — obligations go beyond BAIT.
• TLPT obligation overlooked — significant institutions are tested every 3 years, accreditation of testers required.
• Third-party register incomplete — all ICT service providers, not only critical ones.
• Management body training neglected — Art. 5(4) is mandatory.
• Failure to double-report NIS2/GDPR/DORA — in the event of an ICT incident involving personal data, up to three reporting obligations may apply.