DORA-Compliant Contracts from innus
Legal certainty for IT risk management in the financial sector
Regulation of IT security and risk management continues to grow in the financial sector. Since the Digital Operational Resilience Act (DORA) took effect on 17 January 2025, a new framework for IT risk management has been mandatory for many financial institutions. innus adapted its contracts ahead of that date so that they cover the DORA requirements in full and give customers a comprehensive, legally sound basis.
DORA: new requirements for IT risk management
The Digital Operational Resilience Act (DORA) is a comprehensive legal framework governing operational risk in information and communication technology (ICT) for financial institutions. Its aim is to strengthen the resilience of financial firms against IT and cyber risk. Financial institutions have to ensure that their ICT risk management and their third-party risk management meet the DORA requirements.
The key provisions include establishing a clear framework for IT security processes, reviewing risks at regular intervals, and putting transparent service level agreements (SLAs) in place with third-party providers so that outsourcing arrangements are sound.
DORA-compliant contracts: innus leading the way
From the outset, we provided contracts compliant with the BAIT, which our customers accepted after their own legal review. Adapting the contracts to DORA was a logical next step, so that customers continue to have a legally sound and workable basis. The contracts cover every significant point that financial institutions need as evidence of DORA-compliant IT risk management when dealing with the supervisory authorities.
The minimum contractual content set out in the BaFin implementation guidance forms part of the innus contracts. Customers can therefore locate and tick off each individual point within our contracts. This gives innus customers full transparency and traceability of the contractual content.
What the innus contracts offer for DORA-compliant risk management
The DORA-compliant contracts from innus offer customers several advantages:
Legal certainty: the contracts have undergone legal review and cover the DORA requirements in full, which reduces legal risk.
Simplified IT risk management: financial institutions can rely on compliance with the DORA requirements without having to make extensive adjustments of their own.
Comprehensive service level agreements: the SLAs and outsourcing agreements are drafted so that requirements for IT risk management and for managing third-party risk are met clearly and transparently.
Transparent, pragmatic and developed in Germany
innus takes a transparent and pragmatic approach to drafting its contracts, in line with customer requirements and with the BaFin implementation guidance. Our commitment to being designed, developed and done in Germany means the contracts meet the highest standards and the regulatory requirements that apply.
With its DORA-compliant contracts, innus offers financial institutions a reliable and legally sound basis for their IT risk management. The combination of regulatory clarity and practical contract design makes the innus contracts a valuable support for institutions working to meet the DORA requirements.
For more information about our DORA-compliant solutions and how we can support your IT risk management, get in touch for a consultation.