Practical third-party decisions under DORA: identifying critical or important functions, deciding what counts as an ICT service, open-source and self-hosted software, exit plans, due diligence and assurance, cloud providers and intra-group services.
The DORA definition of a critical or important function and why it matters: it decides which contracts need the extra Article 30(3) clauses, which systems are tested yearly and in TLPT, and what the policy methodology and register must show.
How to decide whether a supplier provides an ICT service in DORA's sense: the definition and its 'ongoing basis' test, the Commission's answer on financial services, one-time purchases, the unanswered software licence question and intra-group providers.
How DORA treats open-source and self-hosted platforms: when software without an ongoing service falls outside the register, why support contracts bring a provider back into scope, and the RTS duties to track open-source libraries and analyse open-source code.
What DORA requires to leave an ICT provider safely: documented and tested exit plans for critical services, termination rights, transition periods and data return in contracts, provider failure in continuity tests and supervisory orders to suspend a provider.
How to vet and keep assurance over ICT providers under DORA: pre-contract assessment and due diligence, information security standards, audit and inspection rights, the assurance sources the policy must name, and checking providers' vulnerability handling.
What DORA means for workloads on hyperscale clouds: the major cloud providers on the critical provider list, concentration risk and substitutability, the Union subsidiary rule, data location clauses, multi-vendor strategy and supervisory last-resort powers.
How DORA handles ICT services supplied within a financial group: the intra-group provider definition, reporting intra-group contracts and chains in the register, non-EU group entities, consolidated registers, CTPP exclusion and internal TLPT testers.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.