The Digital Operational Resilience Act (DORA) has recast third‑party risk management from a best practice into a binding regulatory backbone for financial entities across the EU, placing the management of ICT third‑party providers at the centre of operational resilience obligations. According to the original report, Articles 28–44 set out firms’ duties to integrate ICT third‑party risk into their overall ICT risk frameworks, retain ultimate responsibility for regulatory compliance when outsourcing, and apply proportionate controls to suppliers that support critical functions. [1][4]
Regulatory detail has been fleshed out by the European Supervisory Authorities (EBA, EIOPA and ESMA) through Regulatory Technical Standards that specify ICT risk‑management frameworks, incident classification, templates for supplier information and contractual expectations. Industry guidance places particular emphasis on pre‑contractual due diligence, ongoing monitoring, audit rights and clear termination and exit arrangements to limit legal and operational spill‑over from supplier failure. Firms are expected to demonstrate these controls in line with accepted audit standards and to document risk‑based audit frequencies. [1][6]
Practical implementation coalesces around a repeatable lifecycle: identify and map ICT assets and service dependencies; tier suppliers by criticality; perform rigorous due diligence; embed contractual safeguards and audit rights; test recovery and transition plans regularly; and maintain a single source of truth for responsibilities, reporting and incident communication. The original report sets out a six‑step framework that mirrors this lifecycle and stresses that disruption testing should replicate realistic cyber scenarios with regulatory reporting obligations , notably the 72‑hour window for major ICT incidents. [1][6][7]
Organisational culture and governance are central. DORA expects senior‑level accountability, cross‑department collaboration between procurement, TPRM, business continuity and risk teams, and the embedding of operational resilience into procurement and onboarding decisions. Operational resilience is presented not as a one‑off compliance exercise but as an ongoing programme of resilience testing, staff education and continuous vendor performance oversight. Industry advisors say such cultural shifts are as important as technical controls. [1][6][7]
A material escalation in supervision arrived on 18 November 2025 when the three European Supervisory Authorities published a list of designated critical ICT third‑party providers under DORA. The designation follows a criticality assessment based on financial entities’ registers of information and gives supervisory authorities enhanced oversight powers over providers deemed systemic to the EU financial sector’s stability. The ESAs have also been mandated to pursue international cooperation arrangements and to report periodically on third‑country engagement, recognising the global footprint of many ICT suppliers. This supervisory step materially raises the bar for providers and obliges financial firms to prioritise segregation of Critical ICT Third‑Party Providers (CTPPs) in their vendor tiering and monitoring regimes. [2][3][5]
For financial institutions the immediate implications are concrete: update contractual terms and termination clauses; strengthen audit, testing and exit planning for CTPPs; escalate due diligence and continuous monitoring for high‑criticality suppliers; and ensure internal reporting and incident playbooks align with regulator expectations. Industry data and advisory publications highlight that firms which mapped assets, implemented attack surface management and conducted regular recovery exercises were materially better prepared for the supervisory scrutiny DORA now enables. [1][6][7]
Vendors and platform providers are positioning services to meet demand. The company claims its vendor risk platforms can automate vendor tiering, DORA mapping to standards such as NIST CSF and ISO 27001, and provide continuous monitoring and reporting. Firms should treat such vendor claims with editorial distance and validate them as part of procurement and due diligence, while also recognising that third‑party tooling can materially accelerate compliance workflows when matched to internal governance and testing programmes. [1]
##Reference Map:
- [1] (UpGuard blog) - Paragraph 1, Paragraph 3, Paragraph 4, Paragraph 6, Paragraph 7
- [4] (Digital‑Operational‑Resilience‑Act.com Article 28) - Paragraph 1
- [6] (PwC publication) - Paragraph 2, Paragraph 3, Paragraph 4
- [7] (Accesa article) - Paragraph 4, Paragraph 6
- [2] (EBA press release) - Paragraph 5
- [3] (ESMA press release) - Paragraph 5
- [5] (Digital‑Operational‑Resilience‑Act.com Article 44) - Paragraph 5
Source: Noah Wire Services