DORA · ICT suppliers to the financial sector
Your bank is asking you to respond on DORA. Before you sign, check what you can demonstrate.
Regulation (EU) 2022/2554 requires banks, insurers and payment institutions to oversee their ICT suppliers. The requests reach you as questionnaires and contract clauses. In 21 questions you find out whether you can respond today without declaring controls that are not in place.
The mechanism
Why DORA reaches you too
DORA’s obligations fall on financial entities. Article 28, however, provides that the entity remains fully responsible for its obligations even when it outsources ICT services to third parties.
It must therefore assess the supplier before signing and monitor it for the whole duration of the relationship. In practice, the bank or insurer passes its own requirements on to you: through a questionnaire before signing, through clauses in the contract, through requests for evidence during the relationship.
The regulation has applied since 17 January 2025.
The requests
What you will be asked for
The elements that Article 30 requires, as a minimum, in contracts with ICT suppliers. The second group is added when your service supports a critical or important function of the entity.
In all contracts
- A clear and complete description of the functions and services, including whether, and under what conditions, you may subcontract a service supporting a critical or important function
- The locations where services are provided and data are processed and stored, with an obligation to notify the entity in advance if you intend to change them
- Availability, authenticity, integrity and confidentiality of data, including personal data
- Access, recovery and return of data, in an easily accessible format, at the end of the relationship or in the event of insolvency
- A description of service levels, with their updates
- Assistance to the entity in the event of an ICT incident, at no additional cost or at a cost determined in advance
- Full cooperation with the entity’s competent authorities and resolution authorities
- Termination rights and minimum notice periods
- Participation in the entity’s security awareness and training programmes
If the service supports a critical or important function
- Service levels with measurable quantitative and qualitative targets
- Notice and reporting of developments that affect the service
- Contingency plans implemented and tested, with adequate security measures and policies
- Participation in the entity’s threat-led penetration testing (TLPT)
- Rights of access, inspection and audit for the entity and the competent authority, and cooperation during on-site inspections
- An exit strategy, with a mandatory transition period
The register of information
The entity records every contract with ICT suppliers in a register that it submits to the competent authority. To complete it, it will ask you for data on services, locations and subcontractors.
Concentration
Your supplier’s supplier
Before relying on a supplier, the entity must assess concentration risk. To do so, it will ask you whom you rely on: cloud, data centres, subcontractors. An answer that stops at your own contract leaves the question open.
Before you respond
Where to prepare the evidence
Every “yes” backed by a document
In a DORA questionnaire, an answer is only as good as the evidence behind it: a procedure, a date, a record.
The list of subcontractors
Up to date, with the services each one supports and the locations where it works on the data.
A tested continuity plan
A plan that is written but never exercised does not answer the question on contingency plans.
The audit and exit clauses
Before accepting them, you need to understand what they mean for your company and for your own suppliers.
For the full scope of the regulation, from the financial entity’s side: the DORA readiness checklist.
The path
Where to start
- 01
The readiness check
Twenty-one questions, already set to the “Large groups, banks and insurers” level. Free, calculated in your browser.
- 02
The list of gaps
For each gap, what to do: the minimum requirements first, then the rest.
- 03
If needed, a consultation
Thirty minutes on the questionnaire you have received, to establish what you can sign today and what needs to be prepared.
Frequently asked questions
Before you respond to your client
Does DORA apply directly to my company?
The regulation also names ICT third-party service providers, but it places the ICT risk management obligations on financial entities. The exception is an ICT provider designated as critical by the European Supervisory Authorities, which is subject to direct oversight. For other providers, the obligations arrive through the contract: Article 30(1) requires the rights and obligations of the entity and the provider to be clearly allocated and set out in writing.
What is a “critical or important” function?
It is a function whose disruption would materially impair the financial entity’s performance, soundness or continuity, or its compliance with its obligations. The classification is decided by the entity, not the supplier: it is worth asking your client whether your service supports such a function, because the contract clauses depend on that answer.
Can I reuse answers given for NIS2 or other questionnaires?
In part. Many questions overlap, but what counts is the evidence behind the answer, not the name of the regulation. DORA adds specific topics, such as the exit strategy, testing and audit rights.
Is the readiness check an audit?
No. It is an indicative self-assessment, calculated in your browser: it does not examine your systems and does not anticipate your client’s judgement. Its purpose is to establish, before you reply, whether you are about to declare controls you cannot demonstrate.
The first step
Know what you can sign before you are asked.
Twenty-one questions, set to the requests of banks and insurers. The result appears immediately, calculated in your browser.
Check whether you are ready to respond