Incidents Caused by Third Parties

When a third party provider causes an ICT incident, the firm's responsibility for its own services does not move to the provider. Customers experience the firm's service failing, the firm classifies the incident, and the firm reports it through its own routes. The provider's role is to restore its part of the chain and to give the firm timely, accurate information about cause, scope, and recovery. That division is simple to state and harder to manage in practice, because the firm depends on information it does not control, from a party whose incentives and timetable may differ from its own.

Responsibility stays with the firm because DORA obligations attach to the financial entity, not to its supply chain. A firm cannot transfer its duty to classify, report, communicate, and learn by pointing to a provider's failure. That principle shapes every other decision in a provider caused incident. The firm must still judge the service effect for its own customers, even if the provider describes the fault in narrower terms. It must still decide its classification on the basis of that effect, even if the provider has not yet classified the event in its own terms. And it must still communicate with customers and with its authority, even while it waits for fuller information from the provider.

Getting useful information from a provider during an incident depends on arrangements made before the incident. The contract and the operating procedures should set out what the provider will tell the firm, how quickly, through which channel, and in what form. During the incident, the firm should ask specific questions, about the services affected, the cause as currently understood, the expected recovery path, and the workaround options, rather than accepting a general assurance that the provider is working on the problem. Where the provider's updates are vague or slow, the firm should record that fact, because it is relevant both to the incident report and to the later review of the provider relationship. A firm that waits passively for provider news will find its own reporting and customer communication falling behind.

Classification of a provider caused incident follows the same service effect test as any other incident. The question remains what stopped, for whom, and how seriously, judged from the firm's own service position. The report to the authority should describe the provider's role plainly, distinguishing what the firm knows from what the provider has told it and what remains unverified. That distinction matters, because repeating a provider's explanation as if it were the firm's own finding can mislead the reader and can embarrass the firm if the explanation later changes. The final report should also record the provider's confirmed root cause once it is available, and note any gap between that cause and the firm's own observations.

Customers should be told that the service is affected, what it means for them, and what the firm is doing, without being drawn into a dispute about fault. Naming the provider is sometimes helpful, where it explains why the firm cannot give a precise recovery time, but the message should not suggest that the customer should pursue the provider directly. The firm remains the customer's point of contact, and the message should make that clear by giving the firm's own next update time and contact route. Blaming a provider in a customer message may feel honest in the moment, but it rarely helps the customer and it can complicate the firm's later discussions with that provider about remedy and prevention.

After a provider caused incident, the firm should review both its own response and the provider's performance. Its own review asks whether classification, communication, and reporting were timely despite the dependence on outside information. The provider review asks whether the provider met its contractual duties for notification, information, restoration, and root cause analysis, and whether the relationship needs stronger terms, better monitoring, or an alternative arrangement. Where several firms were affected by the same provider event, the firm should also consider whether its own concentration risk needs attention. Learning from a provider incident therefore has two tracks, and a firm that only reviews its own team has missed half the lesson.