Since 17 January 2025 DORA has applied to banks, insurers, investment firms, payment institutions and many other financial entities. The regulation requires documented ICT risk management, reporting of major incidents, resilience testing and the management of your ICT service providers. Complass guides you through every part and keeps the evidence ready for the supervisor.
Every ICT service belongs in the register of information, with contract, function and subcontractors. The supervisor requests the register every year.
Classify incidents quickly
Fixed criteria decide whether an ICT incident is major and reportable. The initial notification follows within hours.
Responsibility with the management body
The management body bears responsibility for the ICT risk management framework and must approve, oversee and regularly review it.
What applies to your company
DORA applies directly throughout the EU. There is a simplified framework for small and non-interconnected entities; for most others these obligations apply:
ICT risk management framework with strategy, policies, protection, detection, response and recovery, approved and overseen by the management body Art. 5 DORAArticle 5 DORAGovernance and organisation1. Financial entities shall have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk, in accordance with Article 6(4), in order to achieve a high level of digital operational resilience. 2. The management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk …As of: 05.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗Art. 6 DORAArticle 6 DORAICT risk management framework1. Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively and to ensure a high level of digital operational resilience. 2. The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools that …As of: 05.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗
Record ICT-related incidents, classify them by fixed criteria and report major incidents in three stages: initial notification, intermediate report and final report Art. 17 DORAArticle 17 DORAICT-related incident management process1. Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents. 2. Financial entities shall record all ICT-related incidents and significant cyber threats. Financial entities shall establish appropriate procedures and processes to ensure a consistent and integrated monitoring, handling and follow-up of ICT-related incidents, …As of: 05.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗Art. 18 DORAArticle 18 DORAClassification of ICT-related incidents and cyber threats1. Financial entities shall classify ICT-related incidents and shall determine their impact based on the following criteria: - (a) the number and/or relevance of clients or financial counterparts affected and, where applicable, the amount or number of transactions affected by the ICT-related incident, and whether the ICT-related incident has caused reputational impact; - (b) the duration of the ICT-related incident, …As of: 05.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗Art. 19 DORAArticle 19 DORAReporting of major ICT-related incidents and voluntary notification of significant cyber threats1. Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4 of this Article. Where a financial entity is subject to supervision by more than one national competent authority referred to in Article 46, Member States shall designate a single competent authority as the relevant competent authority responsible for carrying …As of: 05.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗
Test digital operational resilience regularly; selected entities additionally with threat-led penetration testing Art. 24 DORAArticle 24 DORAGeneral requirements for the performance of digital operational resilience testing1. For the purpose of assessing preparedness for handling ICT-related incidents, of identifying weaknesses, deficiencies and gaps in digital operational resilience, and of promptly implementing corrective measures, financial entities, other than microenterprises, shall, taking into account the criteria set out in Article 4(2), establish, maintain and review a sound and comprehensive digital operational resilience …As of: 05.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗Art. 26 DORAArticle 26 DORAAdvanced testing of ICT tools, systems and processes based on TLPT1. Financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, which are identified in accordance with paragraph 8, third subparagraph, of this Article, shall carry out at least every 3 years advanced testing by means of TLPT. Based on the risk profile of the financial entity and taking into account operational circumstances, the competent authority may, …As of: 05.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗
Manage ICT third-party risk: strategy, register of information on all ICT services and exit strategies Art. 28 DORAArticle 28 DORAGeneral principles1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and in accordance with the following principles: - (a) financial entities that have in place contractual arrangements for the use of ICT services to run their business operations shall, at all times, remain fully responsible for compliance with, and …As of: 05.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗
Contracts with ICT service providers must contain certain content, such as service description, data processing locations, assistance with incidents, audit rights and termination rights Art. 30 DORAArticle 30 DORAKey contractual provisions1. The rights and obligations of the financial entity and of the ICT third-party service provider shall be clearly allocated and set out in writing. The full contract shall include the service level agreements and be documented in one written document which shall be available to the parties on paper, or in a document with another downloadable, durable and accessible format. 2. The contractual arrangements on the use …As of: 05.10.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗
The risk management, reporting and management duties of the German BSI Act do not apply to financial entities under DORA; DORA takes precedence in this respect Section 28(6) BSIG§ 28 BSIGBesonders wichtige Einrichtungen und wichtige Einrichtungen(1) Als besonders wichtige Einrichtung gelten - 1. Betreiber kritischer Anlagen, - 2. qualifizierte Vertrauensdiensteanbieter, Top Level Domain Name Registries oder DNS-Diensteanbieter, - 3. Anbieter öffentlich zugänglicher Telekommunikationsdienste oder Betreiber öffentlicher Telekommunikationsnetze, die - a) mindestens 50 Mitarbeiter beschäftigen oder - b) einen Jahresumsatz und eine Jahresbilanzsumme von jeweils …As of: 26.09.2026 · Source: gesetze-im-internet.deOpen original (gesetze-im-internet.de) ↗
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
Typical companies
Banks and savings banks Focus area
Credit institutions with in-house or outsourced IT, with register of information and resilience testing.
Insurers
Insurance and reinsurance undertakings, except very small insurers; intermediaries only if they are larger than a medium-sized enterprise (Art. 2(3) DORA).
Payment and e-money institutions
Payment services with high requirements for availability and incident reporting.
Investment firms and asset management companies
Depending on size with a full or simplified ICT risk management framework; small registered managers of alternative investment funds are exempt.
How Complass helps
Implement DORA with guidance
Phases from applicability to the review of the framework, with templates for strategy, policies, testing programme and the reporting and classification plan.
The first selection covers the obligations in Complass if they apply to you. The free applicability check shows whether they do. To the applicability check
What you need at a minimum
If DORA applies to your financial entity: this selection covers the resulting obligations in Complass. It is preselected when you start a trial or order.
Management cockpit: Document that the management body defines, approves and oversees ICT risk management. (Art. 5 DORA (opens in a new tab)) (included)
Business continuity management (BCM): ICT business continuity: business impact analysis, continuity plans and exercises, ISO 22301 included. (Art. 11 DORA (opens in a new tab))
Incident management: included
GDPR, AI Act and Whistleblower protection (HinSchG) (baseline protection): included
Price of the minimum selection
Item
Net price per month
Start S
€179
DORA
included
Business continuity management (BCM)
€79
GDPR, AI Act and Whistleblower protection (HinSchG) (baseline protection)
included
Total
€258 net/month
With annual payment, 12 months minimum term. Monthly payment with a 15 % surcharge. All prices net plus VAT, as of 16 October 2026.
Good to know: You can also meet the obligations without Complass. Complass supports you with implementation and evidence but does not replace legal advice. Legal information
Further packages
You can use the DORA framework today. For ICT service providers to the financial sector we are preparing the industry template "DORA for ICT service providers".
All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 16 October 2026. Enterprise and groups of companies on request.
Packages marked “coming soon” or “in preparation” cannot be booked yet. We will state the price and scope once a package can be booked. We are happy to show you the included frameworks and features in a demo already, as far as they are available.
Frequently asked questions
Do we as a bank also have to implement NIS2?+
For risk management, reporting and management duties DORA takes precedence; the corresponding provisions of the German BSI Act do not apply to financial entities within the scope of DORA (Section 28(6) BSIG). Other provisions, such as registration, are not named in this exemption. Check these points in your individual case.
Does DORA also apply to smaller institutions?+
Yes, but proportionately. Small and non-interconnected investment firms and some other entities apply a simplified ICT risk management framework (Art. 16 DORA). In Germany the Banking Act also extends DORA to further institutions.
Does Complass help with the register of information?+
Yes. The DORA framework contains a working template for the register of information according to the implementing technical standards. Submission to the supervisor takes place via its reporting channel.
