DORA: ICT Third-Party Risk Management
ICT Third-Party Risk Management [Art 28-44]
Rule: Financial entities must manage risks from ICT third-party providers throughout the relationship lifecycle, with specific contractual requirements and oversight for critical providers.
General Principles [Art 28]
Financial entities must:
| Obligation | Description |
|---|---|
| Retain responsibility | Remain fully responsible for compliance despite outsourcing |
| Proportionate management | Risk management proportionate to nature, scale, complexity |
| Maintain oversight | Effective oversight of ICT third-party arrangements |
| Ensure access | Maintain ability to access, audit, and terminate |
Key Policy Requirements [Art 28(2)]
Strategy must address:
- Policy on use of ICT services supporting critical/important functions
- Approach to sub-contracting
- Exit strategies
- Concentration risk management
Register of Information [Art 28(3)]
Must maintain a register of:
| Element | Detail |
|---|---|
| All ICT third-party contracts | Full inventory |
| Services supporting critical functions | Clearly identified |
| Subcontractors | For critical function support |
| Contract details | Start date, termination, service levels |
| Assessment | Risk assessment for each arrangement |
Register must be available to competent authority on request.
Pre-Contractual Assessment [Art 28(4)]
Before contracting, assess:
- Whether arrangement concerns critical/important function
- Supervisory conditions are met
- Appropriate due diligence completed
- Risks are acceptable
Contractual Arrangements [Art 30]
Mandatory contract terms:
| Requirement | Purpose |
|---|---|
| Service descriptions | Clear description of ICT services |
| Data locations | Where data will be processed/stored |
| SLAs | Service levels, quantitative/qualitative targets |
| Incident notification | Provider must notify incidents promptly |
| BCM provisions | Business continuity obligations |
| Termination | Rights and notice periods |
| Transition assistance | Support during exit |
| Access and audit | Right to audit, access to data and premises |
| Sub-contracting | Conditions and approval requirements |
| Data protection | GDPR compliance |
| Governing law | Choice of law (preferably EU) |
Critical or Important Function Contracts [Art 30(2)]
Additional requirements for critical function support:
| Requirement | Detail |
|---|---|
| Full service descriptions | Quantitative and qualitative performance targets |
| Incident procedures | Detailed notification procedures and support |
| BCM testing | Provider participation in testing |
| Termination rights | For various scenarios (breach, insolvency, regulatory order) |
| Exit plans | Transition periods, data migration support |
| Unfettered access | Access by competent authorities |
Sub-Contracting [Art 29]
For critical/important functions:
- Provider must seek prior approval for material sub-contracting
- Financial entity must assess sub-contractor risks
- Chain sub-contracting requires visibility
- Termination rights if sub-contracting creates unacceptable risk
Concentration Risk [Art 29]
Must assess and manage concentration risk from:
- Heavy reliance on single provider
- Limited substitutability
- Multiple entities using same provider
- Geographic concentration
Critical ICT Third-Party Service Providers [Art 31-44]
ESAs designate critical providers based on:
- Systemic importance of financial entities served
- Degree of substitutability
- Number and type of financial entities relying on services
Oversight framework for critical providers:
| Aspect | Mechanism |
|---|---|
| Lead Overseer | ESA designated to oversee provider |
| Oversight plan | Annual assessment plan |
| Information requests | Direct requests to provider |
| Inspections | On-site and off-site |
| Recommendations | Binding or non-binding |
| Remediation | Track implementation of recommendations |
Exit Strategies [Art 28(8)]
Must have exit plans covering:
- Triggers for exit
- Transition timelines
- Data migration
- Alternative providers
- Continued service during transition
- Impact assessment
Third-Country Providers
| Consideration | Requirement |
|---|---|
| Data location | Assess data sovereignty and access risks |
| Audit access | Ensure audit rights are enforceable |
| Supervisory access | Authorities must be able to access information |
| Equivalent protection | Adequate data protection standards |
Due Diligence Checklist
| Assessment Area | Items |
|---|---|
| Financial stability | Solvency, financial position |
| Technical capability | Skills, certifications, infrastructure |
| Security | Security policies, certifications (ISO 27001, SOC 2) |
| Compliance | Regulatory compliance track record |
| BCM | Business continuity capabilities |
| References | Other client experiences |
| Insurance | Professional indemnity coverage |