DORA vs EBA outsourcing guidelines

DORA follows ICT services, ICT systems, ICT third-party providers, subcontractors, and ICT services supporting critical or important functions.

The EBA outsourcing baseline is tied to outsourcing arrangements; DORA treats outsourcing as one way ICT third-party risk can arise, not the full boundary.

Review cloud, SaaS, data, security, resilience, and support services even when procurement did not label the arrangement as outsourcing.

DORA is a binding EU Regulation for digital operational resilience in the financial sector.

The EBA outsourcing guidelines are supervisory guidance for outsourcing governance under sector-specific financial-services legislation, as reflected in DORA's references to earlier outsourcing efforts and ESA guidelines.

Do not close a DORA gap by pointing only to guideline compliance. Show the DORA article, RTS, ITS, register field, contract clause, or incident-reporting artifact that now applies.

DORA defines a critical or important function by material impairment to financial performance, service continuity, soundness, or ongoing compliance if disrupted or defective.

Legacy outsourcing evidence may include criticality classifications, but it must be retested against DORA's ICT-service and function definition.

Attach the critical-or-important-function rationale to each contract, register row, subcontracting decision, exit plan, and incident-impact assessment.

DORA requires a register of information for contractual arrangements on ICT services, maintained at entity and where relevant sub-consolidated and consolidated levels.

The register ITS says earlier ESA outsourcing guidelines expected some financial entities to record specific outsourcing information, sometimes in registers.

Use the outsourcing inventory as a starting dataset, then reconcile it to DORA templates, identifiers, ICT-service categories, supported functions, and subcontractor records.

DORA evidence includes ICT risk framework records, critical-function assessments, register rows, due diligence, contract clauses, subcontractor-chain assessments, access and audit records, exit tests, incident reports, and management-body reviews.

EBA-style outsourcing evidence remains useful where it proves governance, criticality, due diligence, register discipline, and contract oversight, but it must be labelled against the DORA requirement it supports.

Tag each evidence item by obligation: DORA register, DORA Article 30 contract, subcontracting RTS, incident reporting ITS, or legacy outsourcing governance.

DORA creates a major ICT-related incident reporting process with initial notification, intermediate report, final report, standard templates, secure channels, and voluntary notification of significant cyber threats.

The outsourcing baseline is not a substitute for DORA incident reporting, even where a third party performs reporting activity on the financial entity's behalf.

Keep outsourcing incident-notification clauses, but operate DORA classification, authority reporting, template, and client-communication processes separately.

DORA gives competent authorities register access and creates an oversight framework for critical ICT third-party providers, including possible supervisory follow-up where risks are not addressed.

EBA outsourcing guidelines support supervisory review of outsourcing governance, but DORA adds specific ICT third-party oversight and harmonised supervisory data.

Escalate unresolved DORA gaps through management-body reporting, competent-authority readiness, contract remediation, and provider-risk governance rather than treating them as procurement exceptions.

DORA requires written contracts for ICT services and minimum provisions covering service description, locations, data protection, access and return of data, service levels, incident assistance, cooperation with authorities, termination, and training participation.

An EBA-style outsourcing contract may contain useful governance clauses, but it is not enough unless it also covers DORA's ICT-service clause set.

Perform clause-by-clause remediation against DORA Article 30 and the ICT third-party contract-policy RTS.

DORA requires financial entities to assess risks from subcontracting ICT services supporting critical or important functions, including chain complexity, location, data, concentration, monitoring, access, and termination triggers.

A legacy outsourcing file may identify subcontracting permission, but DORA requires operational visibility into ICT subcontractors that underpin critical or important functions.

Require advance notice of material subcontracting changes, a right to approve or object, and termination rights where unapproved or impermissible subcontracting occurs.