DORA Chapter V: Section I (Articles 28 to 30) on how financial entities manage ICT third-party risk and contract for ICT services, and Section II (Articles 31 to 44) on the EU oversight framework for critical ICT third-party service providers.
Managing ICT third-party risk inside the ICT risk framework: the third-party risk strategy and policy, the register of information, pre-contract assessment and due diligence, audit planning, termination rights and tested exit plans.
Assessing concentration risk before contracting ICT services for critical or important functions: substitutability, multiple dependencies on related providers, subcontracting chains, third-country providers, insolvency law and data recovery.
The clauses every ICT services contract must contain, the additional clauses for services supporting critical or important functions (SLAs, audit rights, TLPT participation, exit periods), the microenterprise derogation and the subcontracting terms set by RTS 2025/532.
How the ESAs designate critical ICT third-party providers: the four criteria, the reasoned statement and timelines, exclusions, the yearly list, voluntary opt-in, the EU subsidiary rule for third-country providers, and the first list of 19.
What the Lead Overseer assesses at each critical ICT provider (security, continuity, governance, incident reporting, portability, testing, audits, standards), the annual individual oversight plan, and the joint examination teams that support oversight.
The Lead Overseer's powers over critical ICT providers (information requests, investigations, inspections, recommendations including on subcontracting) and the periodic penalty payments of up to 1 % of average daily worldwide turnover for non-compliance.
What happens after the Lead Overseer issues recommendations: the provider's 60-day response, public disclosure, duties on financial entities to address the identified risks, and the last-resort power to suspend or terminate use of a critical provider's service.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.