Classify financial-entity functions, map the ICT services that support them, and preserve the evidence DORA expects across contracts, registers, incidents, testing, and exit planning.
For ICT risk, resilience, outsourcing, procurement, legal, security operations, incident response, audit, and business-service owners who need the classification to drive real controls rather than sit in a spreadsheet.
Structured answer sets in this page tree.
Cited legal and guidance references.
Under DORA, a is a legal impact classification for a business function. It determines which ICT services need tighter risk assessment, contract controls, subcontractor visibility, register-of-information records, testing coverage, and incident classification. Connect each regulated financial service or activity to the ICT systems, providers, data locations, subcontractors, continuity assumptions, and evidence that keep it available and secure.
DORA defines a by impact: the function qualifies when disrupted, defective, or failed performance would materially impair a financial entity's financial performance, soundness, continuity of services and activities, or continued compliance with authorisation conditions and regulatory obligations. The test applies to the function, not to the popularity of a system or the supervisory designation of a provider.
Use one classification record per function and licensed activity. A payments incident response platform, trading venue matching engine, securities settlement workflow, client authentication service, or actuarial calculation process may be supported by many ICT services; the function classification should explain why disruption to those ICT services would or would not impair the regulated activity.
A useful DORA classification is a dependency map. For each function, identify the ICT services that support it, the direct ICT third-party service provider, the contractual arrangement reference number, the service location, data-processing and storage locations, and whether the service is concentrated in one provider or a small provider group.
The map should cover intra-group providers as well as external providers. DORA and the contract-policy RTS treat ICT intra-group service providers as ICT third-party service providers for this purpose; internal group sourcing can change the risk profile but does not remove the need for documented oversight.
DORA's register of information is more than a vendor inventory. It is the record that lets a financial entity, group, supervisor, and Lead Overseer see which ICT contracts and providers support which functions. If the criticality decision is separate from the register, the organization will struggle to prove why a contract, subcontractor, incident, or TLPT scope was treated as higher risk.
The register should make the dependency chain reviewable. For ICT services supporting critical or important functions, the register must include subcontractors that effectively underpin those services, including subcontractors whose disruption would impair the service's security or continuity.
When an ICT service supports a , DORA expects stronger lifecycle control before and during the contract. The contract policy should define how the entity determines which ICT services support critical or important functions, when that assessment is reviewed, who approves and monitors the contract, what due diligence is required, what assurance is accepted, and when exit planning is tested.
Subcontracting needs its own control record. Before allowing a provider to subcontract ICT services supporting critical or important functions or material parts of them, assess whether the provider can identify and monitor relevant subcontractors, pass through access and inspection rights, maintain continuity through the subcontracting chain, notify material changes in time, and support termination where changes exceed the entity's risk tolerance.
mapping changes operational response. Under the incident classification RTS, incidents affecting ICT services or network and information systems supporting critical or important functions are treated as incidents affecting critical services. Malicious unauthorised access to systems supporting those functions is singled out as a serious reporting concern, and service downtime thresholds are tighter where critical or important functions are involved.
Testing also depends on the classification. DORA requires annual appropriate testing of ICT systems and applications supporting critical or important functions for financial entities other than microenterprises. For entities selected for TLPT, the TLPT scope must cover several or all critical or important functions, identify the underlying ICT systems, processes, technologies, and outsourced or contracted ICT services, and preserve the rationale for including or excluding functions from the test scope.
No. The DORA classification depends on whether disrupted, defective, or failed performance would materially impair the financial entity's financial performance, soundness, service continuity, authorisation conditions, or regulatory obligations. A process can be operationally useful without meeting that test, and a provider can be important to the entity without being designated as a critical ICT third-party provider by the ESAs.
Keep the function identifier, criticality rationale, licensed activity, owner, supporting ICT systems, ICT service types, direct providers, contract references, data locations, subcontractor chain, continuity assumptions, incident classification links, test scope decisions, approvals, and reassessment triggers.
Sorena can help connect critical or important function assessments to ICT dependency maps, contract controls, incident classification, testing scope, and evidence requests.
Ask questions tied to cited sources about DORA critical or important functions, ICT dependencies, register records, third-party risk, and evidence.
Review your function classification, ICT service map, provider controls, register fields, and open evidence gaps with Sorena.
"critical services affected"
"methodology for determining"
"scope specification document"
"overall chain of subcontractors"
"standard templates for the register of information"
"several or all critical or important functions"