Annex I of the German NIS-2 implementation act covers banking and financial markets as essential entities. Since 17 January 2025, DORA additionally applies. BAIT and MaRisk remain. The Cybervize platform covers ISMS, TPRM per EBA and supervisory reporting in one solution, with a shared control mapping.
Book the NIS-2 risk check
Banks, insurers and payment service providers fall under NIS-2 Annex I as „essential entity"; for regulated financial entities, DORA takes precedence as lex specialis in most areas. Four consequences of this multi-layer regulation for banks, insurers and regulated financial services. Sector alone is not enough: whether DORA, NIS-2 or both apply depends on entity type, size thresholds and concrete activity. The legally binding evaluation remains a matter for specialised counsel.
Whoever falls under DORA is sector-specifically regulated for financial services. NIS-2 steps back where DORA regulates equivalently or more strictly. In practice: DORA implementation covers most NIS-2 obligations.
Not every financial service entity falls under DORA. Some remain in the pure NIS-2 scope (e.g. certain payment service providers). The Cybervize platform serves both from a single control mapping so that compliance reporting does not run in parallel.
EBA consultation paper CP/2025/12 (draft, not final) outlines a contract register with 19 mandatory fields, subcontractor chains, documented due diligence, concentration risk and exit strategies. Cybervize prepares the register to adapt to the final EBA outsourcing requirements without re-engineering. Outsourcing register on demand for BaFin requests.
Cybersecurity incidents go to the BSI on NIS-2 deadlines. Operational ICT incidents go to BaFin under DORA. Plus BAIT and MaRisk reporting. The reporting logic needs clear triage at the start of an incident.
Five NIS-2 minimum measures per §30, translated for financial services.
Risk register with business processes, IT applications, critical ICT service providers. Concentration risk for cloud providers documented, plus assessment of subcontractor chains.
Contract register aligned with EBA/CP/2025/12 (draft) covering 19 fields, AI-supported contract analysis for gap detection, documented exit strategies for critical outsourcing. Outsourcing audit paths prepared, adaptable to the final EBA wording.
Incident classification: cyber incident (BSI), operational ICT incident (BaFin/DORA), customer harm (BaFin/MaRisk). Triage process at the start of an incident documented.
Advanced resilience testing, periodic, with threat-led penetration tests for significant financial entities. Test results documented on the platform with measure tracking.
Business continuity and disaster recovery plans, BIA by critical functions, RTO/RPO at business process level. Including test documentation for the supervisor.
The Cybervize platform serves ISMS, BCM, TPRM per EBA and assessment from a single data layer. Especially relevant for financial services: TPRM module, group reporting, outsourcing register.
Free 30-minute initial call with an indicative NIS-2 classification, top-5 gaps and a path recommendation.
Learn more Service 02ISMS, compliance and evidence from a single platform. Multi-entity, multi-country, AI-supported.
Learn more Service 03Platform plus permanent CISO function. For organisations without an in-house CISO.
Learn more Service 04Gap assessment, roadmap, implementation via the platform. Fixed price from 4,500 euros.
Learn moreSelf-check available
Free, no signup, around 5 minutes. Detailed evaluation by email if desired.
Industry experience in financial services from 25 years of ISMS practice at PwC, Deloitte and KPMG. Partner and director mandates in DAX banks and insurers. CISO interim mandates in regulated environments are part of the methodology.
Free risk check with indicative classification on DORA scope, NIS-2 status, EBA outsourcing obligations and path recommendation. Ideally with IT risk management plus compliance present.
Book the NIS-2 risk checkMemberships, programmes and partnerships
Structured NIS-2 compliance: gap assessment, roadmap, and implementation in 12 weeks.
Learn moreFree self-check: where do you stand on the ten §30 BSIG measures? 30 questions, instant traffic light.
Learn moreThe ten regulated sectors the Cybervize platform runs in.
Learn moreMany companies treat NIS2 as a tick-box exercise. But compliance is not the same as resilience. The Cross-Border Cybersecurity Tour #2 in Saarbrücken made it clear: a functioning security operation outweighs any tool collection.
70% of SMEs treat NIS2 as a compliance checkbox. But organizations that see it as a strategic lever can turn regulatory requirements into operational excellence and genuine resilience.
