DORA
DORA-Compliance für Finanzunternehmen und ihre IKT-Dienstleister.
IKT-Risiken, Vorfälle, Resilienztests und Drittparteienrisiken in einem System. DORA gilt seit dem 17. Januar 2025.
Was wir für Sie tun
- IKT-Risikomanagementrahmen
- Klassifizierung und Meldung schwerwiegender IKT-Vorfälle
- Pläne für Resilienztests
- Informationsregister für IKT-Drittdienstleister
- Vertragsprüfung nach DORA
Warum AnnexOps
Banken und Versicherer führen KI rasch ein. Wir decken DORA und die AI-Act-Regeln für KI in Kreditwürdigkeitsprüfung und Versicherungstarifierung an einem Ort ab.
Häufig gestellte Fragen
Are we in scope as an ICT provider to a bank?
DORA applies directly to financial entities. As an ICT third-party provider you are mainly affected through your contracts: your financial-entity customers must include DORA’s contract requirements and list you in their Register of Information. Providers designated as critical are also overseen directly by the European Supervisory Authorities.
What goes in the Register of Information?
Every contractual arrangement a financial entity has with ICT third-party providers: who the provider is, which services and functions it supports, whether those are critical or important functions, the subcontracting chain, contract dates and where data is stored and processed. Supervisors can request it, and it is reported to them regularly.
How do DORA and NIS2 overlap?
For financial entities, DORA is the sector-specific law: where it applies, its ICT risk-management and incident-reporting rules take precedence over NIS2’s. Much of the work, such as risk management, incident handling and supplier security, maps across both, so we manage it once.
