ICT Third-Party Risk Management
A DORA guide to ICT third-party risk as one chain from selection to exit, showing why a supplier dependency stays with the financial entity throughout the contract.
Line 09: ICT third-party risk
Managing the risk that arrives with a supplier: selection, contracting, oversight, exit, and the difference between a supplier and a dependency.
The line guide
Working guides on this line
Benchmarking Third-Party Performance
Benchmarking ICT provider performance under DORA: comparing service, cost and resilience against peers and past performance, and recognising what a benchmark cannot prove.
Contracting for ICT Services
How contracting for ICT services under DORA turns selection and due diligence into enforceable rights: audit access, security duties, cooperation in incidents, and a workable exit.
Due Diligence Before Contracting
What due diligence before contracting looks like under DORA: checking a provider against the specific service it will support, and testing whether the evidence matches that service.
Exit Strategies for ICT Providers
How exit strategies for ICT providers work under DORA: planning departure before it is needed, so data, knowledge and transition assistance are available when a service must move.
Oversight During the Contract
How oversight during an ICT contract works under DORA: monitoring the service that depends on the provider, checking that evidence matches that service, and acting on early warning signs.
Selecting ICT Third Parties
How a financial entity selects an ICT provider under DORA, judging fit for the service, replaceability and concentration before price or familiarity decides the choice.
Sub-Outsourcing and Fourth Parties
Why sub-outsourcing matters under DORA: a chain of providers can hide the party that actually runs a service, and visibility plus contractual flow-down are what keep that chain manageable.
Third-Party Incident Notification
How third-party incident notification works under DORA: a supplier incident becomes the entity's incident when it affects its service, and cooperation plus clear roles decide how well it is handled.
Third-Party Risk and Data Protection Boundaries
Where DORA third-party risk ends and data protection begins: the same provider may be an ICT supplier and a data processor, and each role needs its own terms, evidence and accountability.
Third-Party Risk Registers
What a third-party risk register is under DORA: a current, service-linked record of providers and risks that supports oversight, incident response and exit, not a list for its own sake.
When a Supplier Becomes Critical
How a supplier becomes critical under DORA: not always by appointment at signing, but by drift, growth and concentration, until a service cannot run or recover without it.