--- title: "DORA ICT third-party risk and contract clauses guide" canonical_url: "https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/third-party-risk-and-contract-clauses" source_url: "https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/third-party-risk-and-contract-clauses" author: "Sorena AI" description: "Official source DORA guide for financial entities in scope, ICT third-party risk, contract clauses, subcontracting controls, register evidence, audit rights, exit planning, and oversight." published_at: "2026-05-09" updated_at: "2026-05-26" keywords: - "DORA" - "ICT third-party risk" - "DORA contract clauses" - "critical or important functions" - "subcontracting" - "register of information" - "audit rights" - "exit strategies" - "contract clauses" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # DORA ICT third-party risk and contract clauses guide Official source DORA guide for financial entities in scope, ICT third-party risk, contract clauses, subcontracting controls, register evidence, audit rights, exit planning, and oversight. *Artifact Guide* *EU* ## DORA ICT Third-Party Risk and Contract Clauses A practical DORA guide for financial entities in scope reviewing ICT service contracts, critical or important functions, subcontracting chains, register records, audit rights, exit plans, and evidence. Start by checking whether the ICT service supports a critical or important function. It is relevant when procurement, legal, ICT risk, security, resilience, outsourcing, internal audit, and business-service owners need one cited view of what the contract and register must show. DORA applies to financial entities in scope of Article 2, and it treats ICT third-party risk as part of the entity's own ICT risk management framework. The first practical decision point is whether the ICT service supports a critical or important function. If it does, the contract review has to do more than collect security schedules: it must document the arrangement in the register of information, preserve access and audit rights, control subcontracting, and maintain a credible exit route. ## Start with the DORA third-party risk baseline The first control point is accountability. DORA Article 28 says financial entities remain responsible for compliance when they use ICT services to run business operations, and it requires ICT third-party risk to be managed inside the ICT risk management framework. For arrangements that support critical or important functions, the review should connect three records: the business function assessment, the written contract, and the register of information. If those records disagree, the contract is not ready for approval. - Classify the ICT service and the supported business function before negotiation reaches final terms. - Record whether the service supports a critical or important function and who approved that assessment. - Check concentration risk before signing, including non-substitutability, multiple dependencies on the same provider, and difficult migration paths. - Confirm that the contract can be terminated in DORA-relevant failure scenarios, including significant breaches, material performance changes, weak ICT risk management, or supervisory impediments. - Keep the management-body reporting line visible for contracts that support critical or important functions. Sources for this answer: - [Regulation (EU) 2022/2554 (DORA)](https://eur-lex.europa.eu/eli/reg/2022/2554/oj?ref=sorena.io) - Supports the accountability, register, pre-contracting, concentration-risk, termination, and exit-strategy baseline in DORA Articles 28 to 30. - [Delegated Regulation (EU) 2024/1773 on ICT third-party contract policy](https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj?ref=sorena.io) - Specifies what the policy for ICT services supporting critical or important functions must cover across planning, due diligence, monitoring, documentation, and exit. ## Build the register of information from the contract, not after it DORA requires a register of information for contractual arrangements on ICT services, and the register must distinguish arrangements that support critical or important functions from those that do not. The register is not only a reporting file; it is evidence for internal ICT risk management, supervision, and critical-provider oversight. The register ITS turns the contract into structured data. For a contract supporting a critical or important function, the evidence package should include the contractual reference number, parties and identifiers, function identifier, ICT service type, direct provider, relevant subcontractors, service supply chain rank, substitutability assessment, last audit date, exit-plan status, reintegration possibility, discontinuation impact, and alternatives. - Create the register entry before signature or renewal so missing fields can be fixed in the contract. - Use stable provider identifiers such as LEI or EUID where the ITS requires them for legal-person ICT providers. - Record all direct ICT third-party services and the subcontractors that effectively underpin ICT services supporting critical or important functions or material parts of them. - Tie each critical or important function to the relevant ICT service, provider, subcontracting chain, and exit assessment. - Review register data for correctness and consistency at entity, sub-consolidated, and consolidated levels where applicable. Sources for this answer: - [Implementing Regulation (EU) 2024/2956 on DORA register templates](https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj?ref=sorena.io) - Defines the standard register templates, supply-chain ranking, provider identifiers, data-quality expectations, and critical-function assessment fields. - [Regulation (EU) 2022/2554 (DORA)](https://eur-lex.europa.eu/eli/reg/2022/2554/oj?ref=sorena.io) - Requires financial entities to maintain and update the register and make it available to competent authorities on request. ## Check the minimum contract clauses before signature DORA Article 30 sets minimum written-contract content for ICT services. For every ICT service arrangement, the contract needs a clear allocation of rights and obligations, a complete service description, service levels, locations, data protection provisions, cooperation duties, termination rights, and incident assistance. For ICT services supporting critical or important functions, DORA adds stronger clauses: precise service-level targets, notice and reporting obligations for material developments, contingency-plan and ICT security requirements, cooperation in relevant resilience testing, ongoing monitoring rights, unrestricted access, inspection and audit rights, and exit strategies with an adequate transition period. - Describe all functions and ICT services, including whether subcontracting of a critical or important function or material parts of it is permitted. - List regions or countries where services are provided and where data is processed or stored, plus advance-notice duties for location changes. - Include availability, authenticity, integrity, confidentiality, access, recovery, and return-of-data provisions. - Set quantitative and qualitative service-level targets for critical or important functions and define corrective actions when levels are not met. - Preserve access, inspection, audit, testing, documentation-copy, and cooperation rights for the financial entity, appointed third parties, competent authorities, and resolution authorities where DORA requires them. - Document termination rights, minimum notice periods, exit transition periods, migration support, and in-house reintegration options. Sources for this answer: - [Regulation (EU) 2022/2554 (DORA)](https://eur-lex.europa.eu/eli/reg/2022/2554/oj?ref=sorena.io) - Article 30 is the primary source for written ICT contract content and the additional clauses for critical or important functions. - [Delegated Regulation (EU) 2024/1773 on ICT third-party contract policy](https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj?ref=sorena.io) - Requires the contract-policy lifecycle to cover planning, due diligence, approval, implementation, monitoring, documentation, record-keeping, exit, and termination. ## Control subcontracting chains for critical or important functions Subcontracting is not a background procurement detail under DORA. If an ICT third-party provider may subcontract a service supporting a critical or important function, the contract should define what is eligible for subcontracting, the conditions for use of subcontractors, the approval or objection process, and the provider's continuing responsibility for subcontracted services. The subcontracting RTS requires financial entities to assess the chain before entering into the arrangement and periodically afterwards. That assessment should cover the provider's ability to identify relevant subcontractors, subcontractor resources and controls, locations, data processing and storage locations, concentration risk, transferability, continuity impact, and obstacles to audit, inspection, and access rights. - Identify the overall chain of subcontractors for ICT services supporting critical or important functions or material parts of them. - Treat intra-group ICT subcontractors as subcontractors where they provide ICT services supporting critical or important functions or material parts. - Require advance information on intended material subcontracting changes early enough for the financial entity to assess risk. - Keep a reasonable notice period for the financial entity to approve or object to material subcontracting changes. - Reserve termination rights where unapproved or objected-to material subcontracting changes are implemented, or where subcontracting occurs outside the contract's permitted scope. - Update the register and risk assessment when subcontracting changes affect service continuity, security, location, data processing, or supervision. Sources for this answer: - [Delegated Regulation (EU) 2025/532 on subcontracting ICT services](https://eur-lex.europa.eu/eli/reg_del/2025/532/oj?ref=sorena.io) - Specifies the elements to determine and assess when subcontracting ICT services supporting critical or important functions or material parts. - [Regulation (EU) 2022/2554 (DORA)](https://eur-lex.europa.eu/eli/reg/2022/2554/oj?ref=sorena.io) - Requires subcontracting permissions and conditions to be addressed in contracts for ICT services supporting critical or important functions. - [Implementing Regulation (EU) 2024/2956 on DORA register templates](https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj?ref=sorena.io) - Requires register data on subcontractors that effectively underpin ICT services supporting critical or important functions or material parts. ## Use oversight and evidence to keep contracts enforceable A DORA contract file should be reviewable by management, internal audit, competent authorities, and, where a provider is designated as critical, the relevant oversight structure. Oversight does not supersede the financial entity's own responsibility: contract evidence must show that the entity can monitor the provider, act on shortcomings, and exit without disrupting business activities, regulatory compliance, or client service continuity. Critical ICT third-party provider designation is handled by the ESAs through the Joint Committee, with criteria covering systemic impact, financial-entity reliance, critical or important functions, direct and indirect reliance through subcontracting, and substitutability. The register of information is a key data source for that designation and oversight process. - Keep the signed contract, service-level descriptions, location schedule, subcontracting permissions, data-return provisions, audit-right clauses, and exit-plan terms together. - Save due-diligence evidence on provider resources, information security, business continuity, authorisations or registrations, conflicts of interest, and willingness to support audits. - Track performance through service indicators, control indicators, independent reviews, audits, certifications, provider reports, and documented remediation of shortcomings. - Do not rely only on provider certifications or audit reports over time; check their scope, freshness, testing basis, and coverage of key systems and controls. - Store exit-plan evidence: tested scenarios, transition schedule, alternative providers or in-house options, data migration route, continuity measures, and any reintegration assessment. - Record whether a provider is designated as a critical ICT third-party service provider and whether oversight recommendations or supervisory measures require contract updates. **What is the first contract question under DORA for an ICT provider?** Ask whether the ICT service supports a critical or important function. That answer drives the register entry, pre-contract risk assessment, required clauses, subcontracting controls, audit rights, and exit-plan depth. **Does a provider certificate replace DORA audit rights?** No. Certifications and provider audit reports can support assurance, but DORA contract-policy rules require the financial entity to assess their scope and retain the contractual right to perform individual or pooled audits where needed. **Which subcontractors need to appear in the DORA evidence file?** For critical or important functions, focus on subcontractors that effectively underpin the ICT service or whose disruption would impair service security or continuity. The register ITS links those subcontractors to the ICT service supply chain. Sources for this answer: - [Delegated Regulation (EU) 2024/1502 on critical ICT third-party provider designation](https://eur-lex.europa.eu/eli/reg_del/2024/1502/oj?ref=sorena.io) - Specifies the criteria and assessment approach used by the ESAs when designating critical ICT third-party service providers. - [Delegated Regulation (EU) 2024/1773 on ICT third-party contract policy](https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj?ref=sorena.io) - Grounds the evidence expectations for due diligence, audits, independent reviews, monitoring, shortcomings, exit plans, and termination processes. - [Regulation (EU) 2022/2554 (DORA)](https://eur-lex.europa.eu/eli/reg/2022/2554/oj?ref=sorena.io) - Establishes the oversight framework for critical ICT third-party service providers and the financial entity's continuing responsibility. *Recommended next step* *Placement: before sources* ## This DORA guide helps review provider contracts and register records Sorena can help map ICT provider contracts to DORA clauses, subcontracting conditions, register fields, audit-right evidence, and exit-plan records. - [Open Research Copilot for DORA](/solutions/research-copilot.md): Ask cited questions about ICT third-party risk, critical or important functions, contract clauses, subcontracting, oversight, and evidence. - [Review DORA third-party contract evidence](/contact.md): Walk through provider contracts, register fields, audit rights, subcontracting controls, and exit plans with Sorena. ## Primary sources - [Regulation (EU) 2022/2554 (DORA)](https://eur-lex.europa.eu/eli/reg/2022/2554/oj?ref=sorena.io) - Primary DORA source for ICT third-party risk principles, register duties, pre-contract assessments, concentration risk, contract clauses, exit strategies, and oversight. - Quote: "Managing of ICT third-party risk" - [Delegated Regulation (EU) 2024/1773 on ICT third-party contract policy](https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj?ref=sorena.io) - Specifies the detailed content of the policy for contractual arrangements on ICT services supporting critical or important functions. - Quote: "contractual arrangements" - [Implementing Regulation (EU) 2024/2956 on DORA register templates](https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj?ref=sorena.io) - Defines the register-of-information templates, provider identifiers, service supply-chain fields, data-quality principles, and critical-function assessment data. - Quote: "register of information" - [Delegated Regulation (EU) 2025/532 on subcontracting ICT services](https://eur-lex.europa.eu/eli/reg_del/2025/532/oj?ref=sorena.io) - Specifies the elements financial entities must determine and assess when subcontracting ICT services supporting critical or important functions or material parts. - Quote: "subcontracting ICT services" - [Delegated Regulation (EU) 2024/1502 on critical ICT third-party provider designation](https://eur-lex.europa.eu/eli/reg_del/2024/1502/oj?ref=sorena.io) - Supports the oversight section by specifying the ESA approach to designating ICT third-party service providers as critical. - Quote: "designate an ICT third-party service provider" ## Related Topic Guides - [DORA Critical or Important Functions: mapping ICT dependencies and evidence](/artifacts/eu/digital-operational-resilience-act/critical-and-important-functions.md): How DORA critical or important functions affect ICT service mapping, third-party contracts, register-of-information records, incidents, testing, and evidence. - [DORA deadlines and compliance calendar for financial entities](/artifacts/eu/digital-operational-resilience-act/deadlines-and-compliance-calendar.md): Calendar the official source DORA dates and recurring evidence: 17 January 2025 application, incident reporting clocks, register updates, annual reporting, TLPT cadence, and CTPP oversight milestones. - [DORA ICT Third-Party Contract Remediation Workflow](/artifacts/eu/digital-operational-resilience-act/contract-remediation-workflow.md): A DORA workflow for remediating ICT third-party contracts covering critical or important functions, subcontracting, audit rights, exits, register updates, and evidence. - [DORA ICT Third-Party Contracts FAQ](/artifacts/eu/digital-operational-resilience-act/faq/ict-third-party-contracts.md): What DORA requires in ICT third-party contracts, including critical or important functions, audit and access rights, termination, exit, subcontracting, register updates, and evidence. - [DORA incident classification forms: criteria, fields, and reporting clocks](/artifacts/eu/digital-operational-resilience-act/incident-classification-forms.md): Official source guide to DORA ICT incident classification forms: major-incident criteria, significant cyber-threat notifications, report fields, time limits, evidence, and reclassification records. - [DORA incident clock workflow: classification, reports, deadlines, and evidence](/artifacts/eu/digital-operational-resilience-act/incident-clock-workflow.md): Official source DORA workflow for starting the major-incident reporting clock, classifying ICT incidents, submitting initial, intermediate, and final reports, and preserving authority evidence. - [DORA major ICT incident reporting: classification, reports, and timing](/artifacts/eu/digital-operational-resilience-act/major-incident-reporting.md): Official source DORA guide to major ICT-related incident classification, initial notifications, intermediate and final reports, competent authority routing, and significant cyber threat notifications. - [DORA major ICT incident thresholds: what triggers reporting?](/artifacts/eu/digital-operational-resilience-act/faq/major-incident-thresholds.md): FAQ on DORA major ICT-related incident classification thresholds, recurring incidents, reporting triggers, and evidence inputs based on EU DORA RTS and ITS texts. - [DORA Register of Information FAQ: ICT Third-Party Arrangements](/artifacts/eu/digital-operational-resilience-act/faq/register-of-information.md): FAQ on the DORA register of information: who maintains it, which ICT third-party arrangements it covers, template fields, critical functions, reporting, data quality, and evidence. - [DORA Register of Information Import and Build Workflow](/artifacts/eu/digital-operational-resilience-act/roi-import-and-build-workflow.md): Build a DORA register of information from procurement, vendor, contract, service, function, and subcontractor data using the official register templates and validation checks. - [DORA Register of Information Template: ICT Provider Fields and Evidence](/artifacts/eu/digital-operational-resilience-act/dora-register-of-information-template.md): An official source DORA register of information template for ICT third-party contracts, provider hierarchy, critical functions, dates, statuses, reporting, and evidence. - [DORA TLPT selection: who can be required to test?](/artifacts/eu/digital-operational-resilience-act/faq/tlpt-selection.md): FAQ on DORA threat-led penetration testing selection: who identifies financial entities, what criteria are used, what the TLPT authority validates, and what evidence to keep. - [DORA vs EBA outsourcing guidelines: ICT third-party risk comparison](/artifacts/eu/digital-operational-resilience-act/dora-vs-eba-outsourcing-guidelines.md): Compare binding DORA ICT third-party risk duties with the EBA/ESA outsourcing baseline for registers, critical functions, contracts, subcontracting, exit, incident reporting, and evidence. - [DORA vs ISO 22301: ICT resilience and business continuity compared](/artifacts/eu/digital-operational-resilience-act/dora-vs-iso-22301.md): Compare DORA's binding ICT operational resilience duties for financial entities with ISO 22301's business continuity management system requirements. - [DORA vs ISO/IEC 27001: legal ICT resilience obligations and ISMS controls](/artifacts/eu/digital-operational-resilience-act/dora-vs-iso-27001.md): Compare EU DORA and ISO/IEC 27001 across scope, governance, incident reporting, testing, ICT third-party risk, certification, evidence, overlap, and gaps. - [DORA vs NIS2: financial-sector obligations, overlap, and evidence](/artifacts/eu/digital-operational-resilience-act/dora-vs-nis2.md): Compare DORA and NIS2 for financial entities, ICT providers, incident reporting, management accountability, third-party risk, supervisory routes, and reusable evidence. - [DORA vs PSD2 incident reporting: major ICT and payment incidents](/artifacts/eu/digital-operational-resilience-act/dora-vs-psd2-incident-reporting.md): Compare DORA major ICT-related incident reporting with PSD2 major operational or security payment incident reporting, including scope, triggers, report stages, recipients, and evidence. - [EU DORA Applicability Test for Financial Entities and ICT Providers](/artifacts/eu/digital-operational-resilience-act/applicability-test.md): An official source DORA applicability test for financial-entity scope, ICT third-party services, critical or important functions, exclusions, proportionality, and evidence. - [EU DORA Compliance Checklist for Financial Entities](/artifacts/eu/digital-operational-resilience-act/checklist.md): An official source DORA checklist covering ICT risk governance, major incident reporting, resilience testing, TLPT, ICT third-party contracts, register-of-information records, and audit evidence. - [EU DORA Compliance Obligations and Evidence Guide](/artifacts/eu/digital-operational-resilience-act/compliance.md): An official source DORA compliance guide covering ICT risk management, incident reporting, resilience testing, TLPT, ICT third-party risk, registers, governance, oversight, and evidence. - [EU DORA FAQ: scope, incidents, ICT contracts, testing, and evidence](/artifacts/eu/digital-operational-resilience-act/faq.md): Concise DORA FAQ covering who is in scope, proportionality, ICT third-party contracts, register-of-information records, major ICT incident thresholds and reporting, TLPT, testing, enforcement, and evidence. - [EU DORA ICT risk management control baseline](/artifacts/eu/digital-operational-resilience-act/ict-risk-management-control-baseline.md): An official source DORA control baseline for ICT risk governance, asset and dependency mapping, protection, detection, response, recovery, testing, third-party risk, and evidence. - [EU DORA ICT subcontracting chain controls for critical functions](/artifacts/eu/digital-operational-resilience-act/subcontracting-chain-controls.md): DORA guide to ICT subcontracting chains for critical or important functions: prior assessment, contract conditions, register fields, monitoring, exit rights, and evidence. - [EU DORA penalties and fines: enforcement powers and limits](/artifacts/eu/digital-operational-resilience-act/penalties-and-fines.md): Official source guide to DORA enforcement: competent-authority powers, administrative penalties, remedial measures, publication rules, and Lead Overseer penalty payments for critical ICT third-party providers. - [EU DORA Register of Information Data Model: templates, fields, and evidence](/artifacts/eu/digital-operational-resilience-act/register-of-information-data-model.md): Field-level guide to the EU DORA register of information data model: templates B_01 to B_07, provider identifiers, contract links, subcontracting chains, critical-function assessments, dates, and export evidence. - [EU DORA Requirements Overview: ICT risk, incidents, testing, and third-party risk](/artifacts/eu/digital-operational-resilience-act/requirements.md): An official source overview of the main EU DORA requirements for financial entities: governance, ICT risk management, incident reporting, resilience testing, TLPT, ICT third-party risk, register of information, oversight, proportionality, and evidence. - [EU DORA Scope and Covered Entities: financial entities and ICT providers](/artifacts/eu/digital-operational-resilience-act/scope-and-covered-entities.md): Classify whether DORA applies to a financial entity, ICT third-party provider, group arrangement, branch, or critical ICT service dependency. - [EU DORA Scope and Proportionality Workflow](/artifacts/eu/digital-operational-resilience-act/scope-and-proportionality-workflow.md): Classify DORA covered entities, simplified-framework status, critical or important functions, ICT dependencies, evidence records, and governance approvals. - [EU DORA testing and TLPT readiness guide](/artifacts/eu/digital-operational-resilience-act/testing-and-tlpt-readiness.md): An official source DORA guide for resilience testing, TLPT eligibility, authority interaction, test evidence, remediation plans, and avoiding unsupported testing cadence. - [EU DORA TLPT eligibility workflow for financial entities](/artifacts/eu/digital-operational-resilience-act/tlpt-eligibility-workflow.md): Check how DORA TLPT authorities identify financial entities for threat-led penetration testing and what evidence supports scope, readiness, providers, and governance. - [EU DORA TLPT Runbook: scope, providers, reports, and remediation](/artifacts/eu/digital-operational-resilience-act/tlpt-runbook.md): Build a DORA threat-led penetration testing runbook around authority coordination, scope validation, provider controls, active testing, closure reports, remediation, and attestation. - [How does proportionality work under EU DORA?](/artifacts/eu/digital-operational-resilience-act/faq/proportionality.md): An official source FAQ on DORA proportionality: what can be scaled, who may use the simplified ICT risk framework, what evidence supports the decision, and which duties cannot be waived. - [How to build a DORA register of information](/artifacts/eu/digital-operational-resilience-act/register-of-information-how-to-build.md): Build a DORA register of information from contracts, ICT services, providers, functions, subcontractors, risk assessments, audit evidence, exit plans, and export checks. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/third-party-risk-and-contract-clauses