Why DORA is critical now
DORA has applied across the EU since 17 January 2025. Supervisors — in Germany BaFin and, for savings banks, the association audit — are actively inspecting. Many institutions have met the formal requirements but struggle with operational effectiveness:
- A register of information exists, but criticality assessments are inconsistent.
- Incident management is documented, but reporting lines are unclear when it matters.
- Resilience tests are run, but without structured lessons learned.
- Outsourcing contracts are updated, but steering routines are not established.
- Reporting to management and the supervisory board is not audit-proof.
This is where an experienced interim manager comes in — with delivery pace, regulatory experience and the authority to lead across organisational boundaries.
From practice
Head of IT and DORA delivery at a German savings bank
Interim cover for the head of IT: stable IT operations, DORA requirements embedded in the line organisation, IT security audit prepared and supported — with an orderly handover to the successor.
Role: Interim Head of IT. Steering of external IT providers including Finanz Informatik (the savings banks' central IT provider), build-up of the operational information security team, change management and conflict moderation during the FI migration.
The five pillars in delivery
I. ICT risk management
Building and embedding an end-to-end ICT risk framework: identification, protection, detection, response, recovery. Integration with existing risk management and ISMS. Clear roles, reporting lines and KPIs.
II. ICT incident management
Classifying, documenting and reporting major ICT-related incidents. Reporting lines, escalation routines and interfaces to the supervisor — including testing the reporting lines.
III. Digital operational resilience testing
Risk-based test programmes from vulnerability scans and penetration tests to threat-led penetration testing (TLPT) for the largest institutions. Structured lessons learned and evidence of effectiveness.
IV. ICT third-party risk
Complete register of information, criticality assessment of providers, contract updates under Art. 30 DORA, steering routines and exit strategies. Particular focus: steering critical providers such as Finanz Informatik.
V. Information sharing
Structured participation in sharing information on cyber threats and incidents — within groups, with ISACs and with supervisors.
What I deliver on DORA
DORA maturity assessment
A review across the five pillars — strengths, gaps, quick wins. The result is a prioritised roadmap with clear ownership and milestones.
Delivery in the line
Not just advice but operational accountability — as interim Head of IT, COO or DORA programme lead: steering business units, budget responsibility, people leadership.
Steering outsourcing partners
Operational steering of critical providers such as Finanz Informatik, external hosts and IT service partners — including contract management, SLA steering and audit support.
Audit and inspection support
Preparing and supporting IT security audits, BaFin and association inspections. Audit-proof documentation, evidence, action tracking.
Frequently asked questions
What is DORA?
DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) is an EU regulation that has applied to financial entities since 17 January 2025. It creates a single framework for digital operational resilience built on five pillars.
Who is affected by DORA?
Around 20 categories of financial entities — including banks, savings banks, insurers, investment firms, payment institutions and crypto-asset service providers — and, indirectly, their ICT third-party providers. Requirements apply on a risk-based, proportionate basis.
What DORA experience do you bring?
Most recently, from 05/2025 to 09/2026, I was interim Head of IT at a German savings bank, responsible for DORA delivery in the line organisation, steering Finanz Informatik as a critical ICT provider and preparing and supporting an IT security audit. This builds on more than 15 years in financial services, including Barclays and CRIF Bürgel.
When can a mandate start?
We agree the start date in the initial call. Once scope, objectives, reporting lines and duration are defined, a structured onboarding follows.
Discuss your DORA maturity in 30 minutes
Free initial call, confidential. We clarify the starting point, the inspection roadmap and whether an interim mandate is the right lever.
Arrange an initial call →