An ISMS in accordance with ISO/IEC 27001 is the foundation; you add the DORA deltas as an overlay – with one risk methodology, one control framework and shared evidence. VamiSec supports you from gap analysis to integrated operations.
With DORA (Regulation (EU) 2022/2554), a directly applicable legal framework for digital operational resilience in the financial sector has been in force since 17 January 2025 – covering banks, insurers and investment firms as well as payment institutions and crypto-asset service providers. The regulation bundles its requirements into five pillars: ICT risk management (Art. 5–16), incident management and reporting (Art. 17–23), resilience testing (Art. 24–27), ICT third-party risk (Art. 28–44) and information sharing (Art. 45). Supplementary regulatory and implementing technical standards specify the obligations down to the operational level.
The good news: the European Supervisory Authorities (ESAs) explicitly developed the technical standards with the ISO 27000 family in mind and use its terminology. An ISMS in accordance with ISO/IEC 27001:2022 thus provides the governance, risk methodology, control framework and audit cycle on which the DORA implementation builds. Running both frameworks in parallel produces duplicate policies, duplicate risk assessments and duplicate audits. Implemented in an integrated way, a single management system remains – and you add the DORA-specific requirements as an overlay.
The overview shows our mapping of the DORA building blocks to ISO/IEC 27001:2022 at control level – and what DORA requires beyond it.
Six reasons to build DORA on top of your ISMS instead of alongside it.
By their own account, the ESAs took the ISO 27000 family into account when drafting the technical standards on ICT risk management and deliberately use its terminology. Anyone operating an ISMS in accordance with ISO 27001 is already working within DORA's conceptual and control logic.
The risk assessment under Clauses 6.1.2/6.1.3 is extended to cover ICT-supported functions, assets and dependencies under Art. 6 and 8. You assess once – and serve both frameworks.
Policies, the SoA and records remain within a single controlled document set. DORA-specific documents such as the digital operational resilience strategy or the register of information follow the same document control – instead of ageing in a parallel repository.
The 93 controls of Annex A form the basis; DORA and RTS requirements are mapped as an overlay onto existing controls. Every measure is implemented only once and operated only once.
Internal audits under Clause 9.2 and the management review under Clause 9.3 cover both frameworks in a single cycle. Every piece of evidence serves multiple assurance contexts – from the certification audit to supervisory requests.
Instead of building DORA on a greenfield, you concentrate budget and team on what ISO 27001 does not cover: reporting deadlines and formats, the register of information, the testing programme and TLPT, contractual clauses and management body accountability.
Five steps from gap analysis to integrated operations.
We check your ISMS scope against the scope of DORA – a certified ISMS with a limited scope does not automatically cover DORA for the entire financial entity. We then determine your deltas against Art. 5–45 and the relevant RTS and ITS.
The DORA and RTS requirements are mapped onto your Annex A controls, the Statement of Applicability is extended and the overlay controls are defined. The result is a single control framework for both regimes.
We add what DORA additionally requires: reporting processes with deadlines and mandatory templates, the register of information, contract adjustments under Art. 30, the assessment of concentration risk, the independent ICT risk control function and training for the management body.
You establish a testing programme for all ICT systems supporting critical or important functions and assess your TLPT readiness. The internal audit and the management review are extended to include the DORA perspective – one audit cycle, two regimes.
In operations, the cycles interlock: annual review of the ICT risk management framework under Art. 6, maintenance of the register of information, lessons learned from incidents under Art. 13. Findings feed into the improvement process under Clause 10 – for ISO and DORA alike.
VamiSec's AI-native, agentic GRC platform operationalises the integrated implementation.
VamiGRC models DORA and ISO 27001:2022 together in an OSCAL-based framework engine – alongside a total of 22 tier-1 regulations and more than 50 standards and frameworks. The five-stage applicability pipeline leads from regulatory drivers via scope and mapping through to evidence and the SoA; 63% of controls are reused across three or more frameworks – implement once, comply many times. Risks, controls, evidence and suppliers live in a queryable GRC graph instead of separate silos. The platform runs on the Open Telekom Cloud – exclusively in German data centres.
The OSCAL-based engine maps requirements across frameworks and automates cross-mapping – the basis for your DORA overlay on the ISO control framework.
The IMS Repository controls documents in 12 canonical categories – from policies via the SoA to audits. Every action is recorded in an immutable audit log; evidence is cryptographically chained.
A Risk Dashboard unifies all risks in a 5×5 heatmap (inherent/residual) with monetised exposure per business unit and FAIR-based Monte Carlo modelling.
Incident Management runs regulatory deadline clocks, including for DORA, detects reporting obligations automatically and ships with more than 15 playbook templates.
The Third-Party Risk module derives criticality automatically from processes and data and monitors suppliers continuously; the Supplier Contract Wizard maps more than 220 master clauses to controls.
Answers to the questions we are asked most often about DORA and ISO 27001.
No. DORA is a directly applicable EU regulation; there is no official recognition of ISO 27001 certification as proof of DORA compliance. However, the ESAs explicitly developed the technical standards with the ISO 27000 family in mind – your ISMS therefore carries the load as the foundation, while you must additionally implement deltas such as reporting deadlines, the register of information or TLPT.
DORA (Regulation (EU) 2022/2554) has been directly applicable since 17 January 2025. It applies to financial entities such as banks, insurers, investment firms, payment and e-money institutions as well as crypto-asset service providers. The requirements are structured in five pillars: ICT risk management, incident management and reporting, resilience testing, ICT third-party risk and information sharing.
Delegated Regulation (EU) 2025/301 stipulates: initial notification within 4 hours of classification as major, at the latest 24 hours after becoming aware; intermediate report within 72 hours of submitting the initial notification; final report within one month of the (most recently updated) intermediate report. Implementing Regulation (EU) 2025/302 prescribes the standard forms. In Germany, you report to BaFin via the MVP portal.
Under Art. 26, financial entities identified by the supervisory authorities must carry out a threat-led penetration test (TLPT) on live production systems supporting critical or important functions at least every three years. The corresponding RTS (Delegated Regulation (EU) 2025/1190) are aligned with the TIBER-EU framework and govern scope, methodology and requirements for testers. Whether your institution is identified is decided by the supervisor on a case-by-case basis – an early readiness assessment is therefore advisable.
A register of information covering all contractual arrangements with ICT third-party service providers in 15 standard templates (Implementing Regulation (EU) 2024/2956), the binding catalogue of contractual clauses in Art. 30, an assessment of concentration risk before contract conclusion (Art. 29) and exit strategies for critical functions. Added to this is the EU oversight of critical ICT third-party service providers: in November 2025 the ESAs designated the first 19 providers, including AWS, Microsoft and Google Cloud – a status you must take into account in your third-party risk management.
Yes. Art. 4 enshrines the principle of proportionality according to size, risk profile and complexity; Art. 16 defines a simplified ICT risk management framework for certain small institutions, specified by the RTS (EU) 2024/1774 and a BaFin supervisory notice of 21 August 2025. Unlike with an ISMS, however, the scope cannot be tailored freely – DORA sets regulatory minimum requirements.
Talk to our team about your DORA status and your ISMS – we will show you where your synergies lie and which deltas really drive effort.
