DORA

Chapter I (Articles 1 to 4) sets out the subject matter, scope, definitions and the principle of proportionality. Chapter II (Articles 5 to 16) covers ICT risk management, including governance, the ICT risk management framework, protection and prevention, detection, response and recovery, backup policies, learning and communication, and the simplified framework for smaller entities.

Chapter III (Articles 17 to 23) covers ICT-related incident management, classification and reporting. Chapter IV (Articles 24 to 27) covers digital operational resilience testing, including threat-led penetration testing.

Chapter V covers ICT third party risk. Section I (Articles 28 to 30) sets the key principles for sound management of ICT third party risk. Section II (Articles 31 to 44) sets the oversight framework for critical ICT third party providers.

Chapter VI (Article 45) covers information sharing. Chapter VII (Articles 46 to 56) covers competent authorities, powers and penalties. Chapters VIII and IX cover delegated acts and transitional and final provisions.

For all ICT services, Article 30(2) requires a written contract that includes: a clear description of the functions and services; the locations where services are provided and data processed, with notice of changes; provisions on availability, authenticity, integrity and confidentiality of data; access, recovery and return of data on insolvency, resolution, discontinuation or termination; service level descriptions; assistance in ICT incidents at no additional cost or at a cost set in advance; cooperation with competent authorities; termination rights and minimum notice periods; and participation in the entity’s security awareness and resilience training.

Where the service supports a critical or important function, Article 30(3) adds: full service level descriptions with precise quantitative and qualitative performance targets; notice periods and reporting obligations; requirements to implement and test business contingency plans and appropriate security measures; participation in threat-led penetration testing; unrestricted rights of access, inspection and audit; and exit strategies, including a mandatory adequate transition period.

Implementing technical standards set the templates for the register, covering the financial entity, its ICT providers, contractual arrangements, the functions supported, the ICT services and the supply chain behind them, set out in Commission Implementing Regulation (EU) 2024/2956.

Registers are held at entity, sub-consolidated and consolidated level. Competent authorities collect them and pass them to the ESAs, which use them in part to identify candidates for designation as critical ICT third party providers.

Detail sits in technical standards adopted by the European Commission, including standards on the ICT risk management framework, incident classification and reporting, the policy on ICT services supporting critical or important functions, threat-led penetration testing, subcontracting of ICT services supporting critical or important functions, and the register templates. These include Delegated Regulations (EU) 2024/1772, 2024/1773, 2024/1774, 2025/301, 2025/1190 and 2025/532 and Implementing Regulations (EU) 2024/2956 and 2025/302.

Under Article 31, the ESAs designate ICT third party providers as critical, based on criteria including systemic impact, the number and importance of financial entities relying on them, and their substitutability. Each designated provider is assigned a Lead Overseer from among the EBA, EIOPA and ESMA.

The Lead Overseer can request information, conduct general investigations and on-site inspections, and issue recommendations (Articles 35 to 39). Competent authorities can, as a last resort, require financial entities to suspend or terminate use of a provider that does not address recommendations (Article 42).