The complete DORA guide for ICT third-party risk management

DORA is the EU regulation that requires financial entities to prove they can prevent, withstand, and recover from ICT disruption, including disruption caused by critical third-party providers.

DORA applies to credit institutions, payment institutions, electronic money institutions, investment firms, insurance and reinsurance undertakings, AIFMs, UCITS management companies, crypto-asset service providers, and others listed in Art. 2. Swiss-headquartered groups with EU-regulated entities are in scope for those entities. Microenterprises (fewer than 10 staff, under €2M turnover) may use the simplified ICT risk framework under Art. 4.

DORA entered into application on 17 January 2025. National competent authorities began requesting Register of Information submissions and evidence of ICT third-party governance shortly after. Institutions still presenting policy drafts rather than operational evidence are behind the supervisory curve.

Articles 28 to 44 require: a documented ICT third-party risk policy, a Register of Information submitted annually to your NCA, structured pre-contract due diligence (Art. 28(4)), mandatory contractual provisions for critical or important ICT services (Art. 30, detailed in ESA RTS JC 2023/84), concentration risk assessment and monitoring (Art. 29), exit strategies for critical providers (Art. 32), and adapted governance when a provider is designated a Critical ICT Third-Party Service Provider (Art. 31, 33–44).

DORA Art. 30 requires that contracts for critical or important ICT services include: a complete description of the service and SLAs, data location and accessibility clauses, audit and access rights for the firm and its competent authority, security and resilience obligations, incident reporting and cooperation requirements, sub-contracting disclosure and approval rights, business continuity cooperation, and termination and exit support provisions. The ESAs published the detailed RTS on contractual requirements (JC 2023/84) specifying what each element must cover in practice.

ESAs (EBA, EIOPA, ESMA) jointly designate certain ICT providers as CTPPs and subject them to direct supervisory oversight. Major cloud hyperscalers (AWS, Microsoft Azure, Google Cloud) are among those being assessed for designation. If a CTPP is in your Register of Information, you must adapt your governance: the CTPP oversight framework (Art. 33–44) introduces additional obligations around monitoring, reporting, and contractual cooperation. Financial entities should flag every provider in their register that has received or is under assessment for CTPP designation.

The Register of Information is a structured inventory of all ICT contractual arrangements, the ICT services provided, the functions they support, and the full sub-contracting chain. Financial entities must submit it annually to their NCA. EBA and ESMA published the final ITS (EBA/GL/2024/02) specifying the exact data fields and Annex III template format required for submission. Supplier Shield exports the Register directly in the Annex III format.

Yes. DORA requires firms to classify each ICT provider by criticality (critical, important, or standard) based on business impact, substitutability, data sensitivity, and concentration exposure. Criticality tier determines due diligence depth, contractual provision requirements, monitoring frequency, and the exit strategy obligations that apply.

DORA does not set harmonised EU-level fines equivalent to GDPR's 4% of global turnover. Instead, enforcement is delegated to national competent authorities, which may impose administrative sanctions under their own national frameworks. Supervisory findings in DORA reviews (inadequate Registers of Information, missing contractual provisions, undocumented exit strategies) can lead to remediation orders, supervisory letters, and reputational consequences that affect licence conditions. The oversight framework for CTPPs includes the Joint Oversight Network (JON), where ECB, EBA, EIOPA, and ESMA coordinate enforcement.

DORA replaces the EBA Guidelines on Outsourcing Arrangements (GL/2019/02) for ICT-related services and adds material obligations: the Register of Information replaces outsourcing registers with a more structured format and mandatory annual NCA submission; the Art. 30 contractual provisions are more detailed than the outsourcing guidelines required; concentration risk assessment (Art. 29) is now a formal, documented, and reported obligation; and exit strategies must be documented and periodically tested, not just planned. Existing outsourcing registers are a starting point, but almost all firms require material remediation to meet DORA.

DORA focuses on ICT operational resilience for financial entities. GDPR governs personal data protection. NIS2 governs cybersecurity for essential and important entities across sectors. A financial institution subject to DORA may also be subject to GDPR and, depending on jurisdiction, NIS2. The overlapping control obligations (particularly around ICT vendor contracts) can be mapped to shared controls in Acuna GRC so that one assessment satisfies multiple frameworks simultaneously.

Supplier Shield is the TPRM module inside Acuna GRC. It covers the Art. 28–44 obligations: structured vendor register in Annex III format, OSINT-based pre-assessment, Art. 30 contractual gap analysis per contract, concentration risk monitoring and reporting, exit strategy management, and continuous oversight with automatic review triggers. Acuna GRC covers the broader ICT risk management framework (Art. 5–16) and multi-framework control mapping across DORA, GDPR, and ISO 27001.