DORA ICT Third-Party Risk Guide

1. Start from a defensible inventory

Everything in DORA third-party risk depends on knowing which providers you use, which ICT services they supply and which business functions those services support. Most programmes stall here because the inventory lives in procurement, the architecture lives in IT and the contracts live in legal.

Build one record per provider, then one record per ICT service under a contractual arrangement. The service is the unit that matters: a single provider can supply a marginal service and a critical one, and they are governed differently.

• Legal entity name, LEI and country of the provider
• Every contractual arrangement, including intragroup
• ICT services per arrangement, with the function supported
• Data locations and processing countries
• Known subcontractors supporting the service

2. Classify criticality once, consistently

Criticality determines assessment depth, contract requirements, exit planning and Register content. If two analysts classify the same provider differently, every downstream obligation becomes arguable.

Use a scored method covering operational impact, substitutability, data sensitivity, regulatory exposure and recovery tolerance. Record the score, the rationale and the approver. A classification without a rationale will not survive a supervisory review.

3. Assess in proportion to criticality

Sending a 250-question pack to every vendor produces late responses and low-quality answers. Tier the questionnaires: a short baseline for standard providers, a full pack for providers supporting critical or important functions, and targeted add-ons for cloud, payments and core banking.

Track response time, not just completion. The commonest audit finding is not a missing assessment but one completed eleven months late.

4. Make evidence expire loudly

Certifications, pen test reports and SOC 2 attestations all have a validity window. An assessment resting on an expired report is not an assessment. Set expiry on every evidence item at upload, and automate reminders 90, 60 and 30 days ahead.

5. Close the loop with risks and remediation

Findings that never become risks are just notes. Every material finding should convert to a risk with an owner, a due date, a treatment decision and an audit trail of what changed.

This is also what makes board reporting possible: you report movement, not a snapshot.

6. Treat the Register as an output

If your Register of Information is a file someone maintains by hand, it is already out of date. Generate it from the provider, service, contract and function records you maintain day to day, and validate continuously rather than the week before submission.