Does DORA require a permanently employed CISO?
We often hear that DORA can only be met with a permanently employed CISO. The regulation itself does not say so. In principle, a financial entity subject to DORA can use an external CISO for the control function that is commonly read as the second line of defence. What decides it is the specific mandate, independence and the outsourcing rules of the sector.
What Article 6(4) DORA requires
Under Article 6(4) DORA, financial entities other than microenterprises assign the responsibility for managing and overseeing ICT risk to a control function. BaFin calls it the ICT risk control function. The entities ensure an appropriate level of independence of this function to avoid conflicts of interest. They also segregate ICT risk management, control and internal audit functions. The basis is the three lines of defence model or an internal risk management and control model.
Who fills the function is not specified. On 23 October 2026 we searched the German and English texts in the Official Journal. The abbreviation CISO does not appear in either. The German text also lacks the terms for information security officer, employment contract, permanent employment and full time. Article 6 contains no term for staff in the German wording either. DORA therefore sets no requirement for a specific post or type of employment.
That the control function forms the second line is a reading. Article 6(4) lists the three functions in this order but does not expressly equate the control function with the second line. It also allows an internal model. Under Article 4(1), entities apply these rules proportionately. Their size and overall risk profile are among the factors they take into account.
Microenterprises need no control function under Article 6(4). These are financial entities with fewer than ten employees and an annual turnover or balance sheet total of no more than EUR 2 million. Trading venues, central counterparties, trade repositories and central securities depositories never qualify.
What the supervisors say
In its guidance on implementing DORA (as of June 2024), BaFin states: “Nor does DORA stipulate any ban on outsourcing ICT risk management functions.” As an example it cites Article 6(10). Under that provision, financial entities may outsource the verification of compliance with ICT risk management requirements to intra-group or external undertakings. That provision concerns verification, not the control function itself.
BaFin adds that in a specific case, sectoral rules may define requirements, conditions or limits for such outsourcing. The financial entity remains fully responsible for safeguarding ICT risk management. BaFin describes the guidance as non-binding.
At this point BaFin speaks of ICT risk management functions. That the sentence also covers the control function is our reading. The Austrian Financial Market Authority (FMA) supports it in its questions and answers on DORA: “DORA does not define rules for the CISO.” According to the FMA, the ICT risk control function may also be performed by the CISO, provided there is an appropriate level of independence. Where external staff perform the CISO function, the FMA points to defining the tasks and to the sectoral outsourcing rules.
The FMA states that its answers are not a binding interpretation. For German firms they are guidance; BaFin sets the standard.
BaFin compares the ICT risk control function with the information security officer under its former IT circulars BAIT and VAIT. In BaFin's view, the two are similar in position and independence but not identical in design. If the existing information security officer takes on the control function's tasks, BaFin recommends making sure that they also perform the tasks of ICT risk management.
Where the view probably comes from
The idea of a permanently employed CISO probably goes back to these circulars. BAIT required each institution, as a rule, to keep the information security officer function in-house. There was an exception for regional and small institutions without material IT operations of their own, with aligned business models and shared IT service providers for banking processes. In view of the control mechanisms usually present in their association or group, they were allowed to appoint a joint information security officer. The contract had to ensure that this officer could perform the relevant tasks in every institution concerned at all times. Each institution also had to name a contact person for the officer. The option of outside support under a service contract remained unaffected.
VAIT was softer for insurers. Each undertaking should keep the function in-house, and outsourcing was subject to its own requirements.
These rules no longer apply to firms under DORA. BaFin repealed VAIT as of the end of 16 January 2025. Since 17 January 2025, institutions that must run ICT risk management under DORA have been outside the scope of BAIT. BaFin will repeal BAIT completely as of the end of 31 December 2026. DORA contains no requirement to keep the function in-house.
The mandate decides
In the FMA's view, it is firstly necessary to define which tasks the CISO function covers and whether they match those of the control function. We think this order is right for German firms as well. A mandate for policies and training is something other than responsibility for managing and overseeing ICT risk. For material outsourcing, MaRisk also requires the outsourcing contract to specify the service and, where necessary, to delimit it.
If the mandate includes software, each component has to be classified separately. MaRisk excludes ICT services that are subject to ICT third-party risk management under Articles 28 to 30 DORA from its outsourcing section AT 9. In our reading, the CISO's own work is not such an ICT service. A standing mandate is not a one-off or occasional procurement either, which MaRisk exempts from outsourcing. On this reading, AT 9 applies to the CISO service at banks. Our vCISO mandate includes the OdySecure platform, and that part can be an ICT service.
Independence from your own IT provider
Article 6(4) requires the control function to be independent to avoid conflicts of interest, and it separates it from the ICT risk management functions. We conclude: if the external CISO comes from the firm's IT service provider, they assess the operations of their own employer. None of the sources we reviewed prohibits this set-up outright. It does, however, create the conflict of interest the provision aims to avoid.
MaGo requires an appropriate segregation of duties in outsourcing as well, on the provider's side as much as within the undertaking. Under the EBA outsourcing guidelines, the management body remains fully responsible for handling conflicts of interest. Article 6(4) does not set a reporting line; the FMA leaves the organisational design to an individual assessment. If an institution combines the compliance function with the ICT risk control function, which MaRisk expressly allows, a direct reporting line to the management board is required.
Banks: outsourcing under AT 9 MaRisk
For banks supervised by BaFin, MaRisk applies in the version of Circular 06/2026 (BA) of 30 June 2026, the ninth MaRisk amendment. MaRisk does not apply to institutions under direct ECB supervision. Under AT 9 para. 4, activities and processes may generally be outsourced as long as the proper business organisation is not impaired. The management board's executive tasks may not be outsourced. Special standards apply to the special functions of risk control, compliance and internal audit.
In control areas, AT 9 para. 5 allows outsourcing only to an extent that ensures effective oversight of the service. Proper operations must be able to continue when needed, for example when the outsourcing relationship ends. A subsidiary in a group of institutions may fully outsource the three special functions if it is non-material both for the national financial sector and within the group. The same applies to groups whose parent undertaking is not an institution and is domiciled in Germany. Institutions whose balance sheet total does not exceed EUR 1 billion on a four-year average may also outsource compliance and internal audit in full.
MaRisk does not list the ICT risk control function as a special function of its own. It names it as one of the functions with which the compliance function can be combined. Whether it is part of the risk control function, MaRisk does not expressly say. ICT risks count as operational risks there, and the risk control function is in charge of overseeing material risks. The EBA assigns the control function under Article 6(4) to the risk management function and therefore to the internal control functions. It does so in the rationale for its new guidelines EBA/GL/2026/09, which are not yet applicable.
The EBA Guidelines on outsourcing (EBA/GL/2019/02), implemented in Germany through MaRisk, add another layer. Under these guidelines, outsourcing operational tasks of internal control functions always counts as critical or important. The exception is an assessment showing that inadequate performance would not affect the effectiveness of the internal control function.
Suppose an institution assigns the ICT risk control function to the risk control function. We would then read external performance of its tasks as a partial outsourcing of that special function. The special standards of AT 9 para. 4 and the oversight and continuity requirements of para. 5 then apply. Under the explanatory note to para. 2, the institution has to examine with corresponding care how the outsourced activities remain integrated into its risk management. Outsourcing the entire risk control function is a different case, for which para. 5 sets narrow conditions. For banks, we therefore conclude that an external CISO mandate is an option depending on the tasks and sector rules. Where AT 9 applies, effective oversight and continuity must remain assured. Based on the evidence we reviewed, whether the ICT risk control function can be outsourced in full is not conclusively settled.
Insurers: outsourcing under MaGo
Insurers under Solvency II follow MaGo, Circular 09/2025 (VA), in force since 14 October 2025. Its wording on outsourcing, which the German insurance rules call Ausgliederung, is broader here than that of MaRisk. Any undertaking may outsource all key functions and self-defined key tasks. The ultimate responsibility of the entire management board remains, and tasks inherent in the management role cannot be outsourced. Key functions are always considered important, and their outsourcing always requires an outsourcing officer.
MaGo does not mention the control function under Article 6(4). Whether an insurer assigns it to a key function, and whether it counts as an important function, is for the undertaking to assess. Under MaGo, it determines importance on its own responsibility and case by case. The outsourcing requirements depend on that. This assessment therefore belongs at the start of any external mandate.
Small firms and the simplified framework
The simplified ICT risk management framework under Article 16 DORA provides for no ICT risk control function. In Germany, according to BaFin, it covers small and non-interconnected investment firms, small institutions for occupational retirement provision and insurance holding companies. From 1 January 2027, institutions outside the CRR join them, such as guarantee banks and finance leasing and factoring institutions.
In the simplified framework too, control functions and internal audit must be appropriately segregated and independent. These firms may outsource the verification of compliance only to intra-group ICT undertakings or ICT third-party service providers. Asset management companies and payment and e-money institutions have their own outsourcing rules, which we did not review for this article.
Responsibility stays with the management body
Under Article 5(2) DORA, the management body bears the ultimate responsibility for managing ICT risk. It also bears the overall responsibility for the digital operational resilience strategy. Outsourcing does not shift this responsibility, and DORA, BaFin, MaRisk, MaGo and the EBA guidelines all say so.
We work the same way in our mandates. Our vCISO leads the implementation and keeps management informed; obligations and responsibility remain with the organisation and its management. From our references: “Moonfare: Cybervize as Interim CISO for the DORA implementation and the ISO 27001 audit”.
The page on our vCISO describes how we fill the CISO function as a mandate. For a short-term vacancy there is our Interim CISO.
Four questions before the mandate
The sources lead to four questions that should be answered before an external CISO mandate starts.
Which tasks does the mandate cover, and do they match the control function under Article 6(4)?
Is the CISO independent of the units and providers whose ICT risks they are to assess?
Which outsourcing rules apply, AT 9 MaRisk, MaGo or the rules of another sector, and has every component of the mandate been classified?
Who inside the firm steers the mandate, checks its performance and reports to management?
Sources: DORA, Official Journal text; BaFin, guidance notes on implementing DORA in ICT risk management, as of June 2024; BaFin, notes on the simplified framework under Article 16 DORA, August 2025 (in German); BaFin, MaRisk, Circular 06/2026 (BA) (in German); BaFin, MaGo for Solvency II undertakings, Circular 09/2025 (VA) (in German); BaFin, BAIT as amended on 16 December 2024 (in German); BaFin, VAIT as amended on 3 March 2022 (in German); BaFin notice of 10 January 2025 on repealing BAIT and VAIT (in German); FMA, DORA ICT risk management, questions and answers; EBA, Guidelines on outsourcing arrangements (EBA/GL/2019/02); EBA, Guidelines on third-party risk for non-ICT services (EBA/GL/2026/09).