Germany Banking Supervisory Requirements for IT (BAIT)

Why does it matter?

For a German institution still outside DORA, BAIT is what the supervisor examines: the IT strategy, the information security officer, the protection needs assessment, access rights, IT emergency tests and cloud outsourcing. For institutions already under DORA, BAIT is the map from the old supervisory expectations to the DORA ICT risk management framework, which is why the Bundesbank keeps publishing it until the end of 2026.

Key benefits include:

• Binding supervisory expectations

Issued on the basis of section 25a(1) KWG, BAIT is what BaFin and the Deutsche Bundesbank examine in the institutions it still covers.

• A named security function

Paragraph 4.4 requires management to establish the information security officer function, organizationally independent under paragraph 4.5.

• Protection needs decide the controls

Paragraph 3.4 requires a protection needs assessment for integrity, availability, confidentiality and authenticity, owned by the business units.

• Tested emergency plans

Paragraph 10.4 requires IT emergency tests at least annually covering every IT system that supports time-critical activities and processes.

• Cloud is outsourcing

Paragraph 9.1 treats cloud services as outsourcing under AT 9 MaRisk, with a risk assessment before any other IT procurement (9.2).

How does it work?

BAIT has a preliminary remark and twelve chapters: 1 IT strategy, 2 IT governance, 3 information risk management, 4 information security management, 5 operational information security, 6 identity and access management, 7 IT projects and application development, 8 IT operations, 9 outsourcing and other procurement of IT services, 10 IT emergency management, 11 (repealed in the 16 December 2024 version; it covered relationships with payment service users) and 12 critical infrastructures. Each requirement is numbered by chapter and paragraph, with explanations in the right-hand column of the circular, and cross-refers to the MaRisk module it concretizes (for example AT 4.2 for the IT strategy and AT 7.2 for technical and organizational resources).

Management sets an IT strategy consistent with the business strategy with the minimum contents of paragraph 1.2 (organization, standards followed, security objectives, architecture, emergency management, business-unit IT), adopts an information security policy (4.2) and appoints the information security officer (4.4). The institution keeps a current overview of its information network (3.3), assesses protection needs (3.4), derives requirements (3.6), implements operational measures such as vulnerability management, network segmentation, hardening and encryption (5.2), evaluates security-relevant information centrally and rule-based (5.3), and runs authorization concepts (6.2) in which every access is attributable to a responsible person (6.3).

Chapters 8 to 12 cover operations and resilience: an inventory of IT components with configuration, owners and locations (8.2); a risk assessment before any outsourcing or other procurement of IT services, including cloud (9.1 to 9.3); an emergency concept with business continuation and recovery plans (10.1), IT emergency plans with restart, emergency operation and recovery parameters (10.3) and annual tests (10.4); and, for operators of critical infrastructures under the BSI-Kritisverordnung, the KRITIS protection objective applied across the information network (12.1 to 12.3).

Key Elements

• Scope and legal basis (preliminary remark)

Addressees follow AT 2.1 MaRisk; from 17 January 2025 DORA institutions are excluded; basis is section 25a(1) KWG, with section 25b KWG for outsourcing.

• IT strategy and governance (chapters 1 and 2)

Minimum strategy contents (1.2), adequate quantitative and qualitative resourcing of information risk, security, operations and development (2.3), avoidance of conflicts of interest (2.4).

• Information risk and security management (chapters 3 and 4)

Information network overview (3.3), protection needs (3.4), security policy (4.2), information security officer (4.4, 4.5), testing policy (4.8), awareness program (4.9).

• Operational security and access (chapters 5 and 6)

State-of-the-art measures (5.2), early detection with central log evaluation (5.3), authorization concepts (6.2), attributable access (6.3).

• Projects, operations and outsourcing (chapters 7 to 9)

Impact analysis for material changes (7.1), component inventory (8.2), cloud as outsourcing under AT 9 MaRisk (9.1), risk assessment and contract overview for other procurement (9.2, 9.3).

• Emergency management and KRITIS (chapters 10 and 12)

Emergency concept and IT emergency plans (10.1, 10.3), annual IT emergency tests (10.4), KRITIS protection objective for critical infrastructure operators (12.1 to 12.3).

What does it cover?

BAIT addresses credit institutions and financial services institutions supervised by BaFin whose scope follows AT 2.1 MaRisk, excluding since 17 January 2025 every institution that must run ICT risk management under Articles 5 to 15 or Article 16 of DORA. It covers the whole information network: business information, processes, IT systems and processes, network and building infrastructure, and IT services bought from third parties including cloud. Chapter 12 applies only to operators of critical infrastructures under the BSI-Kritisverordnung. The circular ceases to apply at the end of 31 December 2026.

What are its objectives?

BAIT turns the MaRisk principles into IT-specific supervisory requirements for the institutions it still covers.

Give institutions a flexible framework for the technical and organizational equipment of IT under section 25a(1) KWG.

Make information risk and information security management concrete, from protection needs to the information security officer.

Secure identities, access rights, projects, application development and IT operations against the institution's risk situation.

Specify the section 25b KWG outsourcing requirements for IT services, including cloud.

Ensure tested emergency plans for time-critical activities and, for KRITIS operators, the supply security of critical services.

Framework in Context

BAIT is national guidance that DORA (Regulation (EU) 2022/2554) is replacing: DORA's ICT risk management framework, incident reporting, resilience testing and third-party rules now apply directly to most German institutions. BAIT itself tells institutions to follow common standards such as the BSI IT-Grundschutz and the ISO/IEC 270xx series (preliminary remark 3). Outside banking, BaFin's VAIT, ZAIT and KAIT circulars were repealed at the end of 16 January 2025; MaRisk continues as the general risk management circular that BAIT concretized.

Common Framework Mappings

BAIT points institutions to the BSI IT-Grundschutz and the ISO/IEC 270xx series as the standards to follow, and DORA now replaces it for most institutions, so the mappings below show where BAIT evidence carries over.

Mapped frameworks include:

BCBS 239

BSI IT-Grundschutz

EU DORA

GDPR

ISO 27001:2022

ISO 27002:2022

MaRisk

NIST CSF 2.0