Who it’s for

For finance and insurance: DORA under control, providers in view

DORA requires ICT risk management, reporting, resilience testing and control of your service providers. Complass guides you through every part.

Try for free Request a demo

Risk register with rating, owners and treatment in Complass (sample project)

The challenge

Many providers, one register

Every ICT service belongs in the register of information, with contract, function and subcontractors. The supervisor requests the register every year.

Classify incidents quickly

Fixed criteria decide whether an ICT incident is major and reportable. The initial notification follows within hours.

Responsibility with the management body

The management body bears responsibility for the ICT risk management framework and must approve, oversee and regularly review it.

What applies to your company

DORA applies directly throughout the EU. There is a simplified framework for small and non-interconnected entities; for most others these obligations apply:

Frameworks: DORA · ISO 27001 · GDPR · NIS2

ICT risk management framework with strategy, policies, protection, detection, response and recovery, approved and overseen by the management body Art. 5 DORA Art. 6 DORA
Record ICT-related incidents, classify them by fixed criteria and report major incidents in three stages: initial notification, intermediate report and final report Art. 17 DORA Art. 18 DORA Art. 19 DORA
Test digital operational resilience regularly; selected entities additionally with threat-led penetration testing Art. 24 DORA Art. 26 DORA
Manage ICT third-party risk: strategy, register of information on all ICT services and exit strategies Art. 28 DORA
Contracts with ICT service providers must contain certain content, such as service description, data processing locations, assistance with incidents, audit rights and termination rights Art. 30 DORA
The risk management, reporting and management duties of the German BSI Act do not apply to financial entities under DORA; DORA takes precedence in this respect Section 28(6) BSIG

Not sure which frameworks apply to you? Start the applicability check
Costs, effort and time: consultant without Complass, consultant with Complass or in-house with Complass? Open the compliance cost calculator

General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.

Typical companies

Banks and savings banks Focus area

Credit institutions with in-house or outsourced IT, with register of information and resilience testing.

Insurers

Insurance and reinsurance undertakings, except very small insurers; intermediaries only if they are larger than a medium-sized enterprise (Art. 2(3) DORA).

Payment and e-money institutions

Payment services with high requirements for availability and incident reporting.

Investment firms and asset management companies

Depending on size with a full or simplified ICT risk management framework; small registered managers of alternative investment funds are exempt.

How Complass helps

Implement DORA with guidance

Phases from applicability to the review of the framework, with templates for strategy, policies, testing programme and the reporting and classification plan.

More about this feature

Register of information and contracts

Working template for the register of information, contract review under Art. 30 and exit plan per ICT service.

ICT risks and business continuity

Risk register with risk appetite and treatment plan, plus business impact analysis and contingency plans for critical functions.

More about this feature

Assess service providers

Classify ICT service providers, request and review self-assessments and evidence.

More about this feature

Assessment of a risk with likelihood, impact and residual risk in Complass (sample project) — Assess and treat ICT risks

What you need at a minimum as a financial entity

If DORA applies to your financial entity, this selection covers the obligations in Complass. The free applicability check shows whether it does.

minimum selection financial entity

Start package, size S, with Business continuity management

€278 net per month

DORA: ICT risk management, reporting of major ICT-related incidents and testing; the core duties of the BSI Act then do not apply. (Art. 5 et seq., 17 et seq., 24 et seq. DORA; § 28(6) no. 1 BSIG (opens in a new tab))
Management cockpit: Document that the management body defines, approves and oversees ICT risk management. (Art. 5 DORA (opens in a new tab))
Business continuity management (BCM): ICT business continuity: business impact analysis, continuity plans and exercises, ISO 22301 included. (Art. 11 DORA (opens in a new tab))+ €79
Incident management
Also included: GDPR, AI Act and Whistleblower protection (HinSchG) (baseline protection)

Try free for 14 days Order

Recommended

Business

€590 net per month

More impact with Asset management and zones and Supplier Management, room for 10 users and 2 frameworks.

Try Business

Further matching packages

You can use the DORA framework today. For ICT service providers to the financial sector we are preparing the industry template "DORA for ICT service providers".

Prices for businesses, net plus VAT, with annual payment and a 12-month minimum term. Monthly payment with a 15 % surcharge. As of 6 November 2026. Packages marked “coming soon” cannot be booked yet. Enterprise and groups of companies on request. All packages in the price overview

You can also meet the obligations without Complass. Complass supports implementation and evidence and does not replace legal advice. Legal information

Frequently asked questions

Do we as a bank also have to implement NIS2?

For risk management, reporting and management duties DORA takes precedence; the corresponding provisions of the German BSI Act do not apply to financial entities within the scope of DORA (Section 28(6) BSIG). Other provisions, such as registration, are not named in this exemption. Check these points in your individual case.

Does DORA also apply to smaller institutions?

Yes, but proportionately. Small and non-interconnected investment firms and some other entities apply a simplified ICT risk management framework (Art. 16 DORA). In Germany the Banking Act also extends DORA to further institutions.

Does Complass help with the register of information?

Yes. The DORA framework contains a working template for the register of information according to the implementing technical standards. Submission to the supervisor takes place via its reporting channel.

White papers: DORA: digital operational resilience for financial entities and their ICT providers The management body is liable: what § 38 BSIG requires from managing directors

Other sectors and roles: IT service providers and MSPs Cloud, hosting and data centres Critical infrastructure All audiences at a glance

Try Complass with your own data

Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.

Try for free Request a demo