Timeline
DORA-ready in 12 weeks
Gap analysis & scope
DORA gap analysis based on all 5 pillars. Kopexa shows you where you stand, which controls are missing and which you already cover through ISO 27001.
Build ICT risk management
Create ICT risk register, conduct business impact analysis, capture third parties. All in one platform, not in Excel.
Incident reporting & resilience testing
Configure reporting processes, define escalation paths, document test scenarios. Map DORA-compliant processes in Kopexa.
BaFin-ready in 12 weeks
Complete evidence across all DORA pillars. Structured export for BaFin audits. Ongoing monitoring instead of a one-time project.
Gap analysis & scope
DORA gap analysis based on all 5 pillars. Kopexa shows you where you stand, which controls are missing and which you already cover through ISO 27001.
Build ICT risk management
Create ICT risk register, conduct business impact analysis, capture third parties. All in one platform, not in Excel.
Incident reporting & resilience testing
Configure reporting processes, define escalation paths, document test scenarios. Map DORA-compliant processes in Kopexa.
BaFin-ready in 12 weeks
Complete evidence across all DORA pillars. Structured export for BaFin audits. Ongoing monitoring instead of a one-time project.
Traditional DORA projects take 12+ months. Kopexa makes you BaFin-ready in 12 weeks. From 249 EUR/month, self-service or with a partner.
Deep dives
Explore DORA compliance topics in detail.
DORA for Banks and Financial Services
The 5 DORA pillars from a banking perspective. Sanctions, RTS/ITS and MaRisk transition.
ICT Risk Management under DORA
Art. 5-16 in detail: ICT risk register, third-party register and incident reporting.
BaFin Readiness with Kopexa
What BaFin expects in DORA audits. TLPT, resilience testing and export formats.
FAQ
Frequently asked questions about DORA and financial services
What is DORA and who does it affect?
DORA (Digital Operational Resilience Act) is an EU regulation that applies to all financial entities from January 2025: banks, insurers, investment firms, payment service providers and fintechs. Critical ICT third-party providers are also covered. The goal is to strengthen digital operational resilience in the financial sector.
How long does DORA implementation take?
With Kopexa you are DORA-ready in 8-12 weeks. Traditional projects take 12-18 months. Kopexa accelerates through automatic cross-mapping to ISO 27001, pre-built DORA templates and integrated ICT risk management. Optionally with partner support.
Do I need both DORA and ISO 27001?
Yes, in most cases. DORA requires ICT risk management that strongly overlaps with ISO 27001. Kopexa automatically maps which ISO 27001 controls cover DORA requirements. What you implemented for ISO 27001 counts towards DORA. No duplicate effort.
How does ICT risk management work in Kopexa?
Kopexa provides a complete ICT risk register per DORA Art. 5-16. You capture ICT assets, assess risks, define mitigations and track status. The dashboard shows you in real time which risks are open, in progress or mitigated. Everything directly linked to the DORA articles.
What does DORA compliance cost?
With Kopexa you start at 249 EUR/month. Traditional DORA projects often cost six figures. The difference: Kopexa is a platform that stays. Not a one-time project, but ongoing compliance management with automated monitoring. You decide whether to work self-service or with one of our partners.
Does Kopexa meet BaFin requirements?
Yes. Kopexa covers all 5 DORA pillars that BaFin audits: ICT risk management, incident management, resilience testing, third-party risk and information sharing. The structured export delivers BaFin-compliant evidence directly from the platform.
DORA compliance. Without a Big 4 budget.
Let us show you in 30 minutes how Kopexa makes you DORA-ready.