A practical DORA guide for financial entities in scope reviewing ICT service contracts, critical or important functions, subcontracting chains, register records, audit rights, exit plans, and evidence.
Start by checking whether the ICT service supports a critical or important function. It is relevant when procurement, legal, ICT risk, security, resilience, outsourcing, internal audit, and business-service owners need one cited view of what the contract and register must show.
Structured answer sets in this page tree.
Cited legal and guidance references.
DORA has applied since 17 January 2025 to financial entities in scope of Article 2, and it treats ICT third-party risk as part of the entity's own ICT risk management framework. The first practical decision point is whether the ICT service supports a . If it does, the contract review has to do more than collect security schedules: it must document the arrangement in the , preserve access and audit rights, control subcontracting, and maintain a credible exit route.
The first control point is accountability. DORA Article 28 says financial entities remain responsible for compliance when they use to run business operations, and it requires ICT third-party risk to be managed inside the ICT risk management framework.
For arrangements that support critical or important functions, the review should connect three records: the business function assessment, the written contract, and the . If those records disagree, the contract is not ready for approval.
DORA and the cited delegated and implementing regulations are binding. The clause matrix, evidence package, and review sequence on this page are practical controls; they do not create a safe harbour, replace the financial entity's assessment, or turn provider certification into legal compliance.
DORA requires a for contractual arrangements on , and the register must distinguish arrangements that support critical or important functions from those that do not. The register is not only a reporting file; it is evidence for internal ICT risk management, supervision, and critical-provider oversight.
The register ITS turns the contract into structured data. For a contract supporting a , the evidence package should include the contractual reference number, parties and identifiers, function identifier, ICT service type, direct provider, relevant subcontractors, service supply chain rank, substitutability assessment, last audit date, exit-plan status, reintegration possibility, discontinuation impact, and alternatives.
DORA Article 30 sets minimum written-contract content for . For every ICT service arrangement, the contract needs clear rights and obligations, a complete service description, service-level descriptions, service and data locations, data protection provisions, incident assistance at no additional cost or at a pre-agreed cost, authority cooperation, and termination rights. It must also address access, recovery, and return of personal and non-personal data if the provider becomes insolvent, is subject to resolution, discontinues operations, or the contract ends.
For supporting critical or important functions, DORA adds stronger clauses: precise service-level targets, notice and reporting obligations for material developments, contingency-plan and ICT security requirements, cooperation in relevant resilience testing, ongoing monitoring rights, unrestricted access, inspection and audit rights, and exit strategies with an adequate transition period.
A narrow exception applies when the financial entity is a microenterprise: DORA allows it to agree that access, inspection, and audit rights will be delegated to an independent third party appointed by the ICT provider, provided the microenterprise can request information and assurance from that third party at any time. This does not turn a provider certificate into a substitute for the required assurance arrangement.
Subcontracting is not a background procurement detail under DORA. If an ICT third-party provider may subcontract a service supporting a , the contract must define what is eligible for subcontracting, the conditions for use of subcontractors, the approval or objection process, and the provider's continuing responsibility for subcontracted services.
The subcontracting RTS requires financial entities to assess the chain before entering into the arrangement and periodically afterwards. That assessment must cover the provider's ability to identify relevant subcontractors, subcontractor resources and controls, locations, data processing and storage locations, concentration risk, transferability, continuity impact, and obstacles to audit, inspection, and access rights.
A DORA contract file should be reviewable by management, internal audit, competent authorities, and, where a provider is designated as critical, the relevant oversight structure. Oversight does not supersede the financial entity's own responsibility: contract evidence must show that the entity can monitor the provider, act on shortcomings, and exit without disrupting business activities, regulatory compliance, or client service continuity.
Critical ICT third-party provider designation is handled by the ESAs through the Joint Committee, with criteria covering systemic impact, financial-entity reliance, critical or important functions, direct and indirect reliance through subcontracting, and substitutability. The is a key data source for that designation and oversight process.
Reassess the file before a new contract, renewal, or material change, and when the supported function changes criticality, the provider adds or changes a material subcontractor, service or data locations change, an audit or incident exposes a weakness, concentration risk changes, or an exit assumption no longer holds.
Ask whether the ICT service supports a . That answer drives the register entry, pre-contract risk assessment, required clauses, subcontracting controls, audit rights, and exit-plan depth.
No. Certifications and provider audit reports can support assurance, but the financial entity must assess their scope and cannot rely on them indefinitely without checking the provider's systems and controls. For supporting critical or important functions, the contract must preserve DORA access, inspection, and audit rights. A microenterprise may use the specific Article 30(3) arrangement that delegates those rights to an independent third party appointed by the provider while preserving the microenterprise's right to request information and assurance at any time.
For critical or important functions, focus on subcontractors that effectively underpin the ICT service or whose disruption would impair service security or continuity. The register ITS links those subcontractors to the ICT service supply chain.
Sorena can help map ICT provider contracts to DORA clauses, subcontracting conditions, register fields, audit-right evidence, and exit-plan records.
Ask cited questions about ICT third-party risk, critical or important functions, contract clauses, subcontracting, oversight, and evidence.
Walk through provider contracts, register fields, audit rights, subcontracting controls, and exit plans with Sorena.
"criteria for the designation"
"independent review and audits"
"overall chain of subcontractors"
"ICT service supply chain"
"Oversight Framework"