DORA Contract Remediation Workflow

Start with the register of information and procurement inventory, not with a blank contract template. DORA requires financial entities to maintain and update a register of information for contractual arrangements on the use of ICT services provided by ICT third-party service providers.

Create one remediation row per contractual arrangement and link it to the financial entity using the service, the signer, the direct ICT third-party provider, the supported function, the ICT service type, start and end dates, and any termination status. This lets the team identify which contracts need full Article 30 remediation and which only need baseline ICT-service documentation.

For each contract, decide whether the ICT service supports a critical or important function before selecting remediation depth. DORA defines a critical or important function by the effect of disruption, defective performance, or failed performance on financial performance, service continuity, authorisation conditions, or other financial-services-law obligations.

Where a contract supports a critical or important function, the remediation file should also cover concentration risk, subcontracting chains, audit and access rights, business continuity, exit strategy, and notification to the competent authority for planned arrangements or when a function becomes critical or important.

Use a clause matrix for Article 30 remediation. The contract should describe the ICT services and functions, locations of service provision and data processing, service levels, data protection and security commitments, incident assistance, cooperation with authorities, termination rights, notice periods, audit and access rights, business continuity, and exit support.

For contracts supporting critical or important functions, add the enhanced terms: full service level descriptions with quantitative and qualitative targets, notice and reporting duties for developments that may materially affect service delivery, business contingency and ICT security commitments, participation and cooperation in digital operational resilience testing where relevant, ongoing monitoring rights, and unrestricted access, inspection, and audit rights for the financial entity, appointed third parties, and competent authorities.

Subcontracting review should be separate from general supplier due diligence. If an ICT third-party provider may subcontract ICT services supporting critical or important functions or material parts, the contract should say exactly which services may be subcontracted, the conditions for doing so, the provider's monitoring and reporting duties, and the financial entity's rights when subcontracting changes.

The financial entity should be able to identify subcontractors that effectively underpin the ICT service, assess the chain length and complexity, understand where subcontractors and data are located, consider concentration and transferability risks, and preserve equivalent access, inspection, and audit rights through the subcontracting chain.

Do not close a remediation row when the contract is signed but the register and operating evidence still disagree. The close-out package should show the remediated clause set, the risk assessment result, the due-diligence and assurance basis, the subcontracting position, the exit plan, and the updated register fields.

The evidence file should also show how the contract will be monitored after remediation. Delegated Regulation 2024/1773 expects documented monitoring of performance, reports, incident information, service delivery, ICT security, business continuity measures, testing, shortcomings, and updates to the risk assessment.