A risk assessment for banks following VdS guidelines is a systematic process for identifying, evaluating and mitigating security risks, in particular in the area of physical and digital threats. It serves the legally compliant protection of fire alarm systems (BMA), intrusion detection systems (EMA) and IT infrastructures in accordance with standards such as VdS 2095, VdS 2311 and the requirements of BaFin (DORA).

Strategies for financial institutions to achieve legally compliant protection of assets and processes

A precise risk assessment following VdS guidelines is essential for identifying risks and developing legally compliant security concepts. This article examines the critical aspects and the role of independent planning.

Key Takeaways

  • A comprehensive risk assessment following VdS guidelines and BaFin requirements (DORA) is essential for banks in order to systematically identify and mitigate physical and digital risks.
  • The planning of fire alarm systems (DIN 14675, VdS 2095) and intrusion detection systems (VdS 2311) must take account of specific bank risks and meet the highest standards of reliability and legal compliance.
  • Manufacturer independence and independent expertise are crucial for developing optimal, future-proof security concepts and avoiding unnecessary costs and manufacturer dependencies.

The financial sector has always been a prime target for criminal activity while simultaneously being subject to strict regulatory requirements. Protecting banks therefore requires a thorough and continuous examination of potential threats. A sound risk assessment is not merely a statutory obligation but a strategic instrument for safeguarding material assets, sensitive data and operational continuity. VdS guidelines in particular play a central role here, providing detailed specifications for the planning and installation of security systems. The challenge for decision-makers lies in translating these complex requirements into a coherent, future-proof and, above all, manufacturer-independent security concept that does justice to the specific risk profile of a financial institution.

Article image: Risk Assessment VdS Bank - hero

The need for a comprehensive risk assessment in the banking sector

Financial institutions are particularly exposed to a wide range of risks due to their function and the type of assets they manage, from cash to sensitive customer data to critical IT infrastructures. These range from physical threats such as burglary and fire to complex cyberattacks. A comprehensive risk assessment is therefore not an option but an imperative necessity and a statutory obligation. Under the Occupational Health and Safety Act (§ 5 ArbSchG), employers are required to assess working conditions for hazards to employees and to define suitable measures to reduce risk. For banks, this focus extends to the protection of physical assets, business operations and reputation. BaFin (Federal Financial Supervisory Authority) has established clear specifications for ICT risk management and digital operational resilience across the entire financial sector, first with the Banking Supervisory Requirements for IT (BAIT) and now, increasingly, with the Digital Operational Resilience Act (DORA) [1, 5, 6]. Since 17 January 2025, DORA has applied directly in Germany and is progressively replacing BAIT to achieve Europe-wide harmonisation of IT security [5, 6].

Failure to observe these requirements can have far-reaching consequences, ranging from substantial fines and claims for damages to significant loss of trust and reputational harm [2, 14]. Proactive risk management based on a detailed risk assessment enables banks to systematically identify weaknesses and implement preventive measures. This covers not only technical security systems but also organisational processes and staff training. The challenge lies in taking a holistic view of the various risk areas (physical, organisational and ICT-related) and anchoring them in an integrated security concept. PLANATEL® supports financial institutions in analysing these complex requirements and planning tailored, legally compliant solutions that meet the specific threats and regulatory framework.

VdS guidelines as the foundation of physical security in banks

VdS Schadenverhütung GmbH, as an independent organisation of the German insurance industry, plays a decisive role in defining security standards, particularly in the area of physical security. Although its guidelines are not statutory requirements, they are frequently demanded in practice for contractual or insurance reasons and have thus become the de facto standard for high security levels [20, 22]. Several VdS guidelines are of particular importance for banks, placing specific requirements on fire alarm systems (BMA), intrusion detection systems (EMA) and the handling of cash and ATMs.

  • VdS 2095: This guideline describes in detail the requirements for the planning and installation of automatic fire alarm systems. It gives concrete form to the specifications of superordinate standards such as DIN 14675 and DIN VDE 0833 and supplements them with insurance-related aspects to ensure a high level of functional reliability and dependability [8, 20, 23].
  • VdS 2311: The guidelines for intrusion detection systems (EMA) set minimum requirements for the planning, installation, operation and servicing of EMA of classes A, B and C. Commercial premises with a high level of risk, such as banks, often require higher VdS classes (e.g. class C), which mandate comprehensive monitoring and redundant transmission paths to an emergency and service control room (NSL) [3, 11, 13].
  • VdS 2472: These security guidelines address cash-handling processes at business premises and describe risks relating to burglary, theft and robbery arising from cash handling. They define measures for minimising these risks [7, 14].
  • VdS 3465-3: The VdS 3465-3 concept serves as an aid to assessing potential hazards that can arise from the operation of ATMs, and supports the definition of risk-minimising measures.

Compliance with these VdS guidelines is crucial not only for maximising the protection of people and assets but also for securing insurance cover. PLANATEL® has the expertise to integrate these complex guidelines into the planning of your security systems and to ensure that your institution meets the high requirements.

Integrating fire alarm systems (BMA) in accordance with DIN 14675 and VdS 2095

Fire events pose a significant risk to banks that extends far beyond direct material damage. Business interruption, data loss and reputational damage can threaten the very existence of an institution. Planning and implementing fire alarm systems (BMA) is therefore a critical component of any comprehensive security strategy. DIN 14675 and VdS 2095 are the key standards here.

DIN 14675 sets out the requirements for the structure and operation of fire alarm systems and is mandatory in Germany for the planning, design, installation, commissioning, acceptance and servicing of BMA [29, 35]. It defines the qualification requirements for specialist firms and ensures that all phases of a BMA's lifecycle meet the highest standards [29, 38]. For banks, this means that BMA planning must be carried out by qualified personnel who take account of the institution's specific circumstances and risk profile.

VdS 2095 supplements DIN 14675 with insurance-related aspects and is often a contractual requirement of property insurers for the recognition of a BMA [8, 20, 22]. It provides detailed guidance on interface design, the use of innovative detection technologies such as multi-sensor detectors, and the integration of the contents of DIN VDE 0833-2 [8, 23]. VdS 2095 is more demanding than the DIN standard alone, but offers a higher level of security and dependability, which is of immense importance for financial institutions.

When planning fire alarm systems for banks, specific aspects must be taken into account, such as the protection of server rooms, archive areas and customer areas. Precise detection and rapid alerting are crucial for minimising damage and initiating evacuations. PLANATEL® plans fire alarm systems in accordance with these strict standards and guidelines to ensure that your institution is optimally protected. We develop concepts that not only meet current requirements but are also future-proof and offer a high degree of investment security.

Article image: Risk Assessment VdS Bank - mid

Intrusion detection systems (EMA) and access control: VdS 2311 and further standards

Burglary and robbery represent a direct threat to material assets and to the safety of employees and customers at banks. Professional intrusion detection systems (EMA) and effective access control systems are therefore indispensable. The VdS 2311 guidelines are the definitive standard for the planning and installation of EMA in Germany [11, 12]. These guidelines define three VdS classes (A, B, C), with banks and other high-risk commercial premises generally requiring the highest class, C [3, 13]. A class C EMA comprises comprehensive monitoring of all potential points of entry, a highly secure alarm control panel and at least two redundant transmission paths to an emergency and service control room (NSL) [3, 13].

Alongside pure intrusion detection, the integration of access control systems is of decisive importance. These systems govern who has access to specific areas of the institution, when and where, and prevent unauthorised entry. Modern access control systems can use biometric methods, chip cards or PIN codes and are often networked with the EMA and video surveillance systems to enable seamless monitoring and a rapid response to security incidents [16, 18]. DGUV Information 215-612 also provides guidance on the security equipment of credit and financial services institutions, which also covers aspects of access control and cash handling.

A common problem with EMA that are not VdS-certified is false alarms, which can be caused by installation errors, poor-quality components or a lack of maintenance. A VdS-certified system minimises this risk and can also lead to reductions in insurance premiums. PLANATEL® plans integrated security solutions comprising EMA in accordance with VdS 2311 and modern access control systems. In doing so, we take account of your institution's specific requirements to ensure the highest level of security and reliability while maintaining manufacturer independence.

Digital resilience and ICT risk management: from BAIT to DORA

Digitalisation has revolutionised the financial industry but has also created new and complex areas of risk. Cyberattacks, data leaks and IT failures can have devastating consequences for banks. BaFin already created a framework for the technical and organisational equipment of institutions, in particular for the management of IT resources and IT risk management, with the Banking Supervisory Requirements for IT (BAIT) back in 2017 [1, 9, 42]. BAIT gives concrete form to the statutory requirements of § 25a paragraph 1 sentence 3 nos. 4 and 5 of the Kreditwesengesetz (KWG) and requires, among other things, complete documentation of all IT components, networks and business processes as well as robust contingency management [1, 9, 43].

With the Digital Operational Resilience Act (DORA), a European regulation that has applied directly in Germany since 17 January 2025, the requirements for digital operational resilience across the entire financial sector are being further tightened and harmonised [5, 6]. DORA comprises comprehensive specifications for the ICT risk management framework, the reporting of serious ICT incidents, the testing of digital operational resilience and ICT third-party risk management. BaFin has announced that it will progressively repeal BAIT to avoid dual regulation, with full repeal expected by 1 January 2027 [5, 44].

For banks, this means a comprehensive adjustment of their IT security strategies and processes. A pure documentation review is not sufficient; rather, a combination of documentation review, interviews with key personnel and review of implementation is required to determine the state of DORA implementation. PLANATEL® supports financial institutions in analysing their existing ICT infrastructures and processes with respect to DORA. We plan the necessary adjustments and develop strategies for strengthening digital resilience, to prepare your institution optimally for the new regulatory framework while ensuring operational information security.

The structured risk assessment process: a manufacturer-independent perspective

An effective risk assessment is a structured, iterative process that goes far beyond a one-off as-is survey. It forms the basis for all further security measures and must be continuously updated [2, 36]. For financial institutions, it is crucial to carry out this process with the utmost care and with the involvement of independent expertise. The process can be broken down into several steps:

  1. As-is survey and needs analysis: First, all relevant areas of the institution are recorded, from physical locations to IT systems to organisational processes. Existing security systems, processes and potential weaknesses are identified. A detailed needs analysis determines which protection objectives must be achieved.
  2. Hazard identification: Systematic recording of all potential hazards. This covers burglary, fire, robbery, technical failures, cyberattacks, but also environmental risks or organisational shortcomings.
  3. Risk assessment: The identified hazards are assessed in terms of their probability of occurrence and potential extent of damage. An objective assessment is essential here so as not to underestimate risks.
  4. Deriving measures: Based on the risk assessment, suitable protective measures are defined. These can be technical (e.g. BMA, EMA, video surveillance), organisational (e.g. contingency plans, training) or personnel-related in nature. The state of the art and recognised technical security rules must be taken into account.
  5. Implementation and documentation: The planned measures are implemented and fully documented. Complete documentation is essential not only for legal compliance but also for traceability and later reviews [3, 9].
  6. Review and updating: A risk assessment is never complete. It must be reviewed regularly and adapted to new circumstances, technologies or threat situations [4, 36].

PLANATEL® accompanies you through this entire process. As a manufacturer-independent consulting firm, we ensure that the assessment is carried out objectively and that the resulting measures are optimally tailored to your needs, without creating any manufacturer dependency. Our more than 34 years of experience in the field of security systems guarantee a sound and practice-oriented implementation.

Common mistakes and avoiding manufacturer dependency in security concepts

Despite the clear need and detailed specifications, typical mistakes are made time and again when carrying out risk assessments and implementing security concepts. These can significantly impair the effectiveness of measures and lead to unnecessary costs or security gaps in the long term. The most common mistakes include:

  • Incomplete or missing risk assessment: The most serious mistake is not carrying out the assessment at all or doing so inadequately, omitting important areas or underestimating risks [2, 4, 21]. Every relevant area of a financial institution must be covered.
  • Standard solutions without adaptation: Adopting generic security concepts without taking account of the specific risk profile and circumstances of the institution in question leads to suboptimal solutions. Individual adaptation is essential.
  • Lack of updating: Security landscapes and threat scenarios are constantly evolving. A risk assessment that is not regularly reviewed and updated quickly loses its relevance [4, 36].
  • Missing responsibilities and follow-up: Action plans without clear responsibilities and deadlines, and a lack of monitoring of implementation, are ineffective.
  • Manufacturer dependency: One of the biggest challenges is the risk of becoming dependent on a particular manufacturer when planning and implementing security systems. This can lead to inflated costs, restricted flexibility for future expansions or modernisations, and a suboptimal selection of components.

This is exactly where PLANATEL® comes in. Our core philosophy is 100% manufacturer independence and financial independence. We receive no commissions from manufacturers or installers. This enables us to objectively select the best solutions for our clients, solutions that are optimally tailored to their needs and offer the highest technical and economic efficiency. We plan maintenance concepts and select certified installers without carrying out installations or maintenance ourselves. This avoids manufacturer dependency from the outset and secures our clients' long-term investment.

Holistic security strategies and the role of PLANATEL® as an independent partner

Developing a future-proof and robust security strategy for financial institutions requires a holistic approach that integrates all relevant risk areas, from physical security to digital resilience. A one-off risk assessment is only the beginning. Rather, a continuous process of review, adjustment and optimisation is required in order to respond to new threats and technological developments. This includes the regular review of fire alarm systems in accordance with DIN 14675 and VdS 2095, the adjustment of intrusion detection systems in accordance with VdS 2311, and the ongoing development of ICT risk management in accordance with DORA.

PLANATEL® sees itself as your independent and competent partner in this complex environment. Since our founding in 1992, we have accumulated more than 34 years of experience in the planning and consulting of security systems. Our expertise covers:

  • Independent planning: We develop tailored concepts for fire alarm systems, intrusion detection systems, video surveillance systems, access control, security management systems and building management technology, always manufacturer-independent and financially independent.
  • Optimisation of existing systems: We analyse your existing infrastructures and identify potential for technical and economic optimisation, including cost and contract optimisation.
  • Project management: We accompany you from the as-is survey through detailed planning and tendering to acceptance and invoice verification, to ensure smooth and targeted implementation.
  • Legally compliant consulting: We ensure that your security concepts meet current statutory requirements and relevant standards such as DIN 14675, VdS 2095, VdS 2311 and DORA.

Our goal is to find a solution for every client that meets the company's individual requirements, delivers the greatest technical and organisational benefit, and guarantees demonstrable business advantages. With PLANATEL®, you are investing in a secure future, free from manufacturer dependencies and with the assurance of having an experienced and trustworthy partner at your side.

Article image: Risk Assessment VdS Bank - bottom

Next Step

Contact us for a no-obligation initial consultation.

PLANATEL®: Independent planning and consulting since 1992
Tel: 040 / 23 73 02-30
E-Mail: info@planatel.de

Frequently Asked Questions

What is the difference between DIN 14675 and VdS 2095 for fire alarm systems in banks?

DIN 14675 is a German standard that governs the general requirements for the structure and operation of fire alarm systems (BMA) and is mandatory for planning, installation and servicing in Germany [29, 35]. VdS 2095 is a guideline of VdS Schadenverhütung GmbH that supplements DIN 14675 with insurance-related aspects and is often required by property insurers for the recognition of a BMA [8, 20]. VdS 2095 is more detailed and demanding, but offers a higher level of security that is often essential for financial institutions.

What role does DORA play in risk assessment at banks?

The Digital Operational Resilience Act (DORA) is an EU regulation that has applied since 17 January 2025 and places comprehensive requirements on the digital operational resilience of financial undertakings [5, 6]. DORA has a significant influence on risk assessment by setting out detailed requirements for ICT risk management, the reporting of ICT incidents, and the testing of digital resilience. Banks must adapt their risk assessment to these new, Europe-wide harmonised standards in order to remain legally compliant and strengthen their digital security.

How can PLANATEL® support banks with risk assessment?

PLANATEL® supports banks as an independent planning and consulting company throughout the entire risk assessment. This includes the as-is survey, needs analysis, hazard identification, risk assessment and derivation of measures for fire alarm systems, intrusion detection systems, video surveillance and ICT security. Our more than 34 years of experience and our strict manufacturer independence guarantee objective, tailored and legally compliant security concepts that last for the long term and optimise costs.

What risks are typically considered in a risk assessment for banks?

A risk assessment for banks considers a wide range of risks. These include physical threats such as burglary, robbery, fire and vandalism, particularly at ATMs and in cash areas. Equally important are ICT risks such as cyberattacks, data leaks and system failures, which are covered by regulatory requirements such as DORA. Organisational risks, such as inadequate contingency plans or a lack of training, as well as environmental risks, are also taken into account [10, 16, 28, 32, 34].

Legal compliance means that all aspects of the risk assessment and the resulting security measures comply with applicable laws, regulations and guidelines. For banks, these are in particular the Occupational Health and Safety Act, the Kreditwesengesetz (KWG), the requirements of BaFin (BAIT/DORA) and relevant standards such as DIN 14675 and VdS guidelines. Compliance with these regulations is crucial for avoiding legal consequences, fines and reputational damage, and for ensuring insurance cover [1, 2, 4, 5, 6].

What are BaFin's core requirements for the IT security of banks?

BaFin has set out comprehensive specifications for ICT risk management, the reporting of serious ICT incidents, the testing of digital operational resilience and ICT third-party risk management, first with the Banking Supervisory Requirements for IT (BAIT) and now, increasingly, with the Digital Operational Resilience Act (DORA). DORA has been in force since 17 January 2025 and is progressively replacing BAIT in order to harmonise digital operational resilience across the financial sector Europe-wide [1, 5, 6].

Which VdS guidelines are particularly relevant for physical security in banks?

For physical security in banks, VdS 2095 for fire alarm systems (BMA), VdS 2311 for intrusion detection systems (EMA), VdS 2472 for cash handling and VdS 3465-3 for securing ATMs are particularly relevant. These guidelines define detailed requirements for the planning, installation, operation and servicing of the respective security systems [3, 7, 8, 11, 16].

Why is manufacturer-independent planning of security systems important for banks?

Manufacturer-independent planning of security systems is crucial for banks in order to ensure an objective selection of the best technical solutions. It prevents dependency on individual providers, enables cost optimisation and secures flexibility for future adjustments. Independent consultants such as PLANATEL® ensure that concepts are optimally tailored to individual needs and are not influenced by manufacturer interests.

How often should a risk assessment be updated at a financial institution?

A risk assessment is a dynamic process and should not be regarded as a one-off task. It must be regularly reviewed and updated, particularly in the event of changes to working conditions, new technologies, changed threat situations or after security-relevant incidents [4, 36]. An annual review is often advisable to ensure the currency and effectiveness of security measures.

Sources and further information

  • VdS security guidelines for cash, processes of acceptance, issuance, processing, transport and storage
  • Having the security of vault rooms tested | VdS Security Expertise
  • Technical commentaries, application notes on security measures for cash and ATMs, VdS Schadenverhütung GmbH
  • DGUV Information 215-613 "Credit and financial services institutions: operation"
  • Kreditinstitute, VBG