Core duties
DORA addresses financial entities. ICT providers feel it mainly through contracts, questionnaires and audit rights of their customers.
- ICT third-party risk is part of ICT risk management. Responsibility stays with the financial entity (Article 28(1) DORA).
- A register of information on all contracts for ICT services (Article 28(3)).
- Before the contract: assess criticality and risks, apply due diligence, check conflicts of interest (Article 28(4)).
- Only providers with appropriate information security standards (Article 28(5)).
- Termination rights and exit strategies for critical functions (Article 28(7) and (8)).
- Assess concentration risk before the contract (Article 29).
- Minimum contract content (Article 30).
What belongs in the contract
| All contracts (paragraph 2) | Also for critical functions (paragraph 3) |
|---|---|
| Description of services, rules on subcontracting | Precise service levels with figures |
| Locations of service and data processing | Notice and reporting duties of the provider |
| Availability, integrity, confidentiality, data protection | Contingency plans and security measures of the provider |
| Access to data on insolvency or termination | Participation in threat-led penetration testing |
| Assistance with ICT incidents | Access, inspection and audit rights |
| Termination rights and cooperation with authorities | Exit strategy with transition period |
In practice
- List ICT providersRecord all contracts for ICT services, including small software subscriptions.
- Mark functionsMark which contracts support critical or important functions.
- Fill the registerEnter the contracts in the register of information and keep it current.
- Review in advanceBefore each new contract, assess risks, security and concentration.
- Update contractsCompare existing contracts with Article 30 and add missing points.
- Monitor and test exitMonitor performance and test exit plans for critical functions.
Checklist: ICT third-party providers under DORA
For financial entities and their ICT providers.
- All contracts for ICT services recorded.
- Critical or important functions marked.
- Register of information complete and current (Article 28(3)).
- Pre-contract review documented (Article 28(4)).
- Concentration risk assessed (Article 29).
- Contracts compared with Article 30.
- Exit strategy for critical functions tested (Article 28(8)).
- ICT third-party risk strategy reviewed regularly.
You may copy and adapt this list freely.
Frequently asked questions
Since when does DORA apply?
Since 17 January 2025 (Article 64 DORA). Checked on 31 October 2026.
Does DORA apply to ICT providers?
DORA applies directly to financial entities. ICT providers feel it through contracts under Article 30 and their customers' audit rights.
What is the register of information?
A record of all contracts for ICT services (Article 28(3) DORA). It separates contracts for critical or important functions from others. The supervisor can request it.
Sources
- DORA, Articles 28, 29, 30 and 64, Regulation (EU) 2022/2554
Legal sources checked on 31 October 2026. Legal information, not legal advice. For your own case, please ask a professional. The German version is binding.