Discuss your project

FOR BANKS, INSURERS & INTERMEDIARIES

Digital resilience. Made auditable.

Since DORA, digital operational resilience has been a supervisory matter. We support financial entities with ICT risks, backup, vulnerabilities and training.

Discuss financial ITAll industries

FINANCIAL SERVICES & INSURANCE / STARTING POINT

What shapes
your everyday work.

  • 01

    DORA has applied since January 17, 2025

    The management body is responsible for ICT risk management. Supervisors and auditors ask for evidence.

  • 02

    Service providers in focus

    Contracts with ICT third-party service providers belong in the register of information, which is submitted to the FMA every year.

  • 03

    Not everyone is covered

    DORA exempts insurance intermediaries that are micro, small or medium-sized enterprises. Data protection and security of processing apply to everyone.

HOW WE IMPLEMENT IT

Concrete
solutions.

Each building block has its own page. We record which services are included in your offer.

FINANCIAL SERVICES & INSURANCE / YOUR BENEFIT

What you
gain.

  • 01

    ICT risks under control

    Set up risk management, backup and recovery in a structured way.

  • 02

    Incidents ready to report

    Prepare detection, classification and reporting channels.

  • 03

    Service providers documented

    Record contracts with ICT third-party service providers traceably.

SERVICES & SCOPE

Responsibility starts with clarity.

We clarify in advance which services make sense, who is responsible for what and how you can tell that progress is being made.

  • Security and architecture review with a view to DORA
  • Backup and recovery concept
  • Vulnerability and patch management
  • Training on digital operational resilience
  • Microsoft 365 security and identity protection

FRAMEWORK & OBLIGATIONS

What laws and
standards require.

General guidance with sources, as of October 2026. It does not replace legal advice; the assessment of each individual case remains with you.
  • DORA

    DORA since January 17, 2025

    Regulation (EU) 2022/2554 applies to credit institutions, payment and e-money institutions, investment firms, insurance undertakings and other financial entities (Art. 2 and 64). Exempt are insurance intermediaries that are micro, small or medium-sized enterprises (Art. 2(3)(e)).

  • DORA

    Management, backup, training

    The management body bears ultimate responsibility for managing ICT risk (Art. 5(2)). Policies for backup and restoration are required (Art. 12), as is mandatory training for all employees and senior management (Art. 13(6)).

  • DORA

    Incidents and register of information

    Major ICT-related incidents must be reported to the competent authority (Art. 19), in Austria via the FMA Incoming Platform. The register of information on ICT third-party service providers (Art. 28(3)) is submitted to the FMA every year.

  • NISG 2026 (NIS2)

    DORA takes precedence over NIS2

    For entities within the scope of DORA, its provisions take precedence over the Austrian NIS Act (NISG 2026); banking and financial market infrastructures are listed in Annex 1, but the obligations follow from DORA.

  • EU AI Act

    AI in credit scoring and insurance

    AI systems for assessing the creditworthiness of natural persons and for risk assessment and pricing in life and health insurance are considered high-risk (Annex III No. 5(b) and (c) EU AI Act), with obligations from December 2, 2027.

START FOR FREE

Check it
today.

Tools from the TOMORIS Toolbox, free of charge and without an account. A check provides pointers, not a security guarantee.

WHAT SETS US APART

One partner.
Not four.

  • 01FROM A SINGLE SOURCE

    Projects, operations, knowledge, software

    EXPERTS implements, GRID operates, UNIVERSITY enables your team, NEXT develops further – without handover gaps between different service providers.

  • 02OWN PLATFORM

    Operations with GRID

    Monitoring, backup, security and updates work together in one operating model with clear responsibility.

  • 03TRANSPARENCY

    Everything in view with INSIGHT

    Tickets, reports and roadmap in one role-based customer portal instead of scattered across emails.

  • 04PROXIMITY

    Personal in DACH

    Locations in Marchtrenk, Frankfurt am Main and Zurich – with personal points of contact.

FREQUENTLY ASKED QUESTIONS

Answered
briefly.

Does DORA also apply to insurance brokers?

DORA generally covers insurance intermediaries but exempts intermediaries that are micro, small or medium-sized enterprises. Data protection and security of processing apply to everyone.

Does TOMORIS handle DORA reports to the FMA?

No. The financial entity is responsible for reports and for submitting the register of information. We provide technical support: detection, documentation and the data you need for this.

Is TOMORIS itself an ICT third-party service provider within the meaning of DORA?

If we provide ICT services to a financial entity, yes. Our contracts then belong in your register of information, and we coordinate the contractual requirements with you.

THINKING AHEAD

What goes with it.

YOUR NEXT STEP

Let’s take the
next step.

Discuss financial IT. Personal and without obligation.

Discuss financial IT