DORA ICT Third-Party Risk Management

Article 28 requires financial entities to treat ICT third-party risk as an integral part of their own ICT risk management: a risk assessment and due diligence before contract signing, ongoing monitoring throughout the contract term, and for critical providers, an additional concentration risk analysis. Responsibility for ICT risk stays fully with the financial entity regardless of what has been outsourced.

Required clauses include audit and access rights for the financial entity and its supervisor, clear service descriptions with defined service levels, provisions on subcontracting, and termination rights alongside a documented exit strategy for a provider switch. Existing contracts that lack these clauses need renegotiation, which in practice often affects older cloud and outsourcing agreements.

Concentration risk arises when many critical functions depend on few or a single provider, which is often the practical reality with the leading hyperscalers. Assessment covers which critical business functions depend on which provider and how quickly a switch to an alternative provider could realistically happen in a failure scenario. Full avoidance is rarely realistic; the focus is a documented, deliberate risk acceptance backed by a contingency plan.

A risk-based tiering approach works well: not every provider needs the same monitoring depth. Non-critical standard vendors are usually fine with annual reviews, while critical providers with high failure impact need continuous monitoring, for example through SLA metrics and regular status reporting. This prioritization by criticality avoids spreading resources evenly across all providers instead of focusing on the ones that actually carry risk.

The register captures, per contract, the provider name, the type of function performed, its criticality classification, the location of data processing, and details on subcontractors. It must be kept current and available on request from the supervisory authority; a register only updated ahead of an audit doesn't meet the ongoing maintenance obligation.

Contingency plans for critical providers should be regularly tested through simulated failure scenarios rather than existing only on paper. This typically involves checking whether alternative sources or internal fallback solutions would actually be available within the defined recovery time. Test results feed into the ongoing assessment of the provider and can trigger a provider review if weaknesses recur.