DORA ICT Third-Party Contracts

Every ICT services contract should clearly allocate rights and obligations in writing, include service level agreements, describe the ICT services and functions being provided, identify service and data-processing locations, protect availability, authenticity, integrity and confidentiality of data, and cover data access, recovery and return if the provider fails, is resolved, discontinues operations, or the contract ends.

Where the ICT service supports a critical or important function, DORA adds a higher bar: full service level descriptions with quantitative and qualitative performance targets, provider reporting and notice obligations, business-contingency and ICT-security requirements, participation and cooperation in relevant resilience testing, ongoing monitoring rights, unrestricted access, inspection and audit rights for the financial entity or appointed third party and competent authority, and exit strategies with an adequate transition period.

Before signing, DORA requires the financial entity to assess whether the ICT service supports a critical or important function. DORA defines a critical or important function as one whose disruption would materially impair financial performance, soundness, continuity of services and activities, or continuing compliance with authorisation conditions or other financial-services-law obligations.

The assessment should be made before contract signature and reviewed when the service, supported function, data flow, provider, location, subcontracting chain, or business dependence changes. The 2024/1773 RTS also requires the contract policy to establish or refer to the methodology for determining which ICT services support critical or important functions and when that assessment is conducted and reviewed.

If an ICT service supporting a critical or important function may be subcontracted, the contract must say whether subcontracting is permitted and under what conditions. DORA also requires the financial entity to weigh the risks of subcontracting, including long or complex chains, third-country subcontractors, concentration risk, data protection, and whether the chain affects the entity's ability to monitor the contracted function or the authority's ability to supervise it.

The 2025/532 subcontracting RTS makes this more concrete. Before entering the contract, the financial entity must decide whether the provider may subcontract a critical or important ICT service or material part of it. The arrangement should require provider identification of relevant subcontractors, notice of material changes, same access and inspection rights through the subcontracting chain, continuity obligations, location and data-location information where relevant, and termination rights where impermissible or unapproved material subcontracting changes occur.

The contract file should produce evidence for the DORA register of information as well as for legal, procurement, risk, security, outsourcing, and audit review. DORA requires a register for all contractual arrangements on the use of ICT services provided by ICT third-party service providers and requires it to distinguish arrangements that support critical or important functions from those that do not.

The 2024/2956 ITS turns that into structured register data. It requires templates for contractual arrangements, signing entities, providers, entities using ICT services, direct providers and subcontractors, ICT service supply chains, function identifiers, and assessments of ICT services supporting critical or important functions or material parts. The register information must be accurate, complete, consistent, integral, uniform, and valid.