DORA ICT third-party readiness

DORA applies directly to financial entities; as their ICT supplier you mostly feel it through contracts and information requests. Three questions tailor the check. They are not scored.

1. Has any financial-entity customer told you — or is it likely — that your service supports one of their critical or important functions?
2. Do you rely on subcontractors — such as cloud hosting, data centres or outsourced support — to deliver the ICT services your financial customers use?
3. Has any customer said it must carry out threat-led penetration testing (TLPT) that could include your service?

Article 30 of DORA lists the key contractual provisions every ICT services contract with a financial entity must contain. Customers will send addenda to add them — being ready makes negotiation faster.

1. How do you handle DORA contract requirements today? Knock-out Legal / Contracts
2. Are service levels written down for each service, including updates and revisions, so customers can monitor them? Operations
3. Can you guarantee customers access to, recovery of and return of their data in an easily accessible format if you become insolvent, stop trading or the contract ends? Product / Legal
4. Will your contracts accept customer termination rights with minimum notice periods, and commit you to cooperate fully with the customer's competent and resolution authorities? Legal
5. Are you willing to take part in customers' ICT security awareness programmes and digital operational resilience training where they ask? Security lead

From the help text

Many suppliers keep a standard DORA addendum mapped to Article 30 so every customer gets consistent, workable terms.

Where your service supports a customer's critical or important function, Article 30(3) adds stronger provisions on performance, contingency, access and exit.

Asked only if you answer “Yes” to: Has any financial-entity customer told you — or is it likely — that your service supports one of their critical or important functions?

1. Do your service levels include precise quantitative and qualitative performance targets, so customers can monitor them and act if they're missed? Operations
2. Will you notify customers of any development that could materially affect your ability to deliver the service to agreed levels? Account manager / Legal
3. Will you grant customers, their appointed auditors and their competent authority rights of access, inspection and audit — with an agreed way to use alternative assurance where appropriate? Knock-out Legal / Security lead
4. Can you support an exit with a mandatory, adequate transition period — continuing the service while the customer moves to another provider or in-house? Operations / Legal

From the help text

Full service level descriptions with precise targets are required for these services. 'Yes' means measurable targets and reporting that triggers corrective action.

Customers must understand the ICT subcontractors that underpin your service — the register records the supply chain with no fixed limit on depth.

Asked only if you answer “Yes” to: Do you rely on subcontractors — such as cloud hosting, data centres or outsourced support — to deliver the ICT services your financial customers use?

1. Can you give customers a list of the subcontractors that effectively underpin your ICT services, with what each does and where? Procurement / Operations
2. Do your contracts with key subcontractors pass down the security, incident notification, audit and data-location commitments you give financial customers? Legal / Procurement
3. Do you give customers advance notice of material changes to subcontractors, so they can assess the risk and object if needed? Account manager

From the help text

Customers' registers include subcontractors that underpin the service, and their position in the chain. 'Yes' means a maintained list with names, identifiers, roles and locations.

Some financial entities must run advanced threat-led penetration tests on live systems. ICT suppliers can be asked to participate and cooperate fully.

Asked only if you answer “Yes” to: Has any customer said it must carry out threat-led penetration testing (TLPT) that could include your service?

1. Are you prepared to participate and cooperate in a customer's TLPT — including agreed rules of engagement, points of contact and safeguards for other customers? Security lead
2. Have you agreed with the customer, in writing, how TLPT involving your service will work — notice, scope limits, safeguards, confidentiality and liability? Legal / Security lead

From the help text

DORA expects suppliers to take part in TLPT that covers their service. 'Yes' means an agreed internal approach and named contacts.

Financial entities must classify and report major ICT-related incidents to their competent authority within tight deadlines. They'll need fast, accurate information and help from you.

1. Within how many hours of detecting an incident affecting a financial customer's service would you notify them? Security lead / Operations
2. Will you assist customers during ICT incidents related to your service at no extra cost, or at a cost agreed in advance? Legal / Operations
3. What independent security assurance can you give customers? Select all that apply. Security lead
4. When did you last test your business continuity and disaster recovery plans for the services financial customers use? Operations
5. I confirm these answers are accurate and reflect commitments we can deliver to financial-entity customers. Managing director

From the help text

Customers' own reporting clocks for major incidents run in hours, so many ask suppliers to notify within a few hours and no later than 24.