DORA and the Exit Strategy – What Every Business Can Learn from Banks

Since January 2025, banks and insurers have had a new task: with the Digital Operational Resilience Act (DORA), they need to show that their IT keeps working even when something goes wrong. One point is especially interesting: the exit strategy. That's a plan for how to switch IT providers. It's an idea that does every business good.

DORA in brief

DORA is an EU regulation for the financial sector. Among other things, it requires:

• good IT risk management,
• a process for security incidents,
• regular testing of their own resilience,
• a register of all important IT service providers,
• and an exit strategy for important services.

The basic idea: you shouldn't be so dependent on a single provider that you couldn't switch any more.

Why this is interesting for you too

You don't have to be a bank to benefit from this idea. Just ask yourself:

• What happens if my most important IT service is unavailable for a day?
• Can I easily get to all my data?
• Could I switch to another provider if prices or terms change?

If you have a relaxed answer to these questions, you'll sleep better.

How open source helps

An exit strategy is easy when your data is in open formats and the software is built on open standards. That's exactly one of open source's strengths:

And because you choose the server yourself with open source, you can also switch hosting providers without changing the software.

An exit strategy for small businesses

It doesn't have to be a thick document. One page is often enough:

1. Which services are important? For example email, files, accounting.
2. How do I get to the data? Try an export once.
3. What would the alternative be? Note one option per service.
4. Who does what? Briefly note who takes care of things if it ever comes to it.

If you like, we can go through this together – it's part of my consulting too.

An example from a small law firm

A law firm with five people goes through the exit questions once:

It turns out that almost everything can be exported easily; only one service has a cumbersome export. That's exactly where it's worth calmly looking for a more open solution.

A few terms, briefly explained

• Resilience: The ability to keep working during disruptions and recover quickly.
• Concentration risk: When many important services sit with a single provider.
• Register of information: Under DORA, an overview of all IT providers and their services. On a small scale, a simple list is enough.
• Exit plan: The documented way to leave a service in an orderly manner.

Why an exit strategy is relaxing

It's not about constantly switching providers. Quite the opposite: if you know you could switch at any time, you can stay relaxed – and decide calmly if prices, terms or requirements change.

Conclusion

DORA is made for banks, but the idea behind it fits everyone: never be so dependent that you couldn't switch. With open formats and open-source software, an exit strategy is almost built in.

If you'd like to give it a try, I'm happy to help – just drop me a line.