DORA Compliance Guide for ICT Vendors and EU Financial Entities (2025)

Who DORA Applies To: Financial Entities and ICT Third-Party Providers

DORA Article 2(1) lists 21 categories of EU financial entity subject to DORA's full requirements: credit institutions, payment institutions, account information service providers, electronic money institutions, investment firms, crypto-asset service providers (CASPs under MiCA), central securities depositories, central counterparties, trading venues, trade repositories, managers of alternative investment funds and UCITS, insurance and reinsurance undertakings, insurance intermediaries, occupational pension funds, credit rating agencies, statutory auditors, crowdfunding service providers, securitisation repositories, and data reporting service providers.

ICT third-party providers — every software vendor, cloud provider, data analytics service, and technology company whose services are used by any of these entities — are subject to DORA's Article 30 contractual requirements and, if designated Critical Third-Party Providers (CTPPs), to direct ESA oversight. There is no general exemption for small ICT providers, though the proportionality principle in Article 4 allows financial entities to apply simplified frameworks for non-material third parties.

Financial entities must maintain an ICT Third-Party Register of all their ICT service provider relationships, classified by whether each relationship supports a critical or important function (CIF). ICT vendors supporting CIFs receive the full weight of DORA's Article 30 contractual requirements and are often listed in supervisory reports submitted to NCAs. If you serve EU financial clients and have not yet been asked to complete a DORA vendor questionnaire or sign a DORA contract addendum, expect that request shortly.

The Five DORA Pillars: What Each Requires

1. ICT Risk Management (Articles 5–16)

Financial entities must establish, implement, and maintain a robust ICT risk management framework with four mandatory layers: a governance and organization layer (ISMS-equivalent policies and designated responsibility at management body level); an identification and protection layer (comprehensive asset inventory, network architecture maps, and technical controls); a detection layer (monitoring and logging systems capable of identifying anomalous ICT activity); and a response and recovery layer (tested business continuity and disaster recovery plans with defined RPO/RTO targets). For ICT vendors: your financial entity clients will require evidence of your own ICT risk management controls as part of their third-party risk due diligence. DORA allows financial entities to rely on third-party certifications (ISO 27001, SOC 2 Type II) as evidence of controls.

2. ICT Incident Management and Reporting (Articles 17–23)

Financial entities must classify, manage, and report ICT incidents using ESA-prescribed classification criteria. The three-phase notification regime for major incidents is binding: initial notification to NCA within 4 hours of classification; intermediate report within 72 hours; final report within 1 month. Financial entities also face annual reporting of ICT threat data to ESAs. For ICT vendors: your contracts with financial clients must include incident notification obligations requiring you to alert clients to incidents affecting their services within a timeframe that allows the client to meet their own NCA reporting deadline. A vendor incident notification gap creating a missed NCA deadline is a contractual liability.

3. Digital Operational Resilience Testing (Articles 24–27)

All financial entities must run basic annual resilience tests (vulnerability assessments, penetration tests, end-to-end tests). Significant financial entities — those meeting NCA-defined thresholds based on size and systemic importance — must additionally conduct Threat-Led Penetration Tests (TLPT) every 3 years using the TIBER-EU methodology. TLPT is supervised by the relevant NCA and uses actual threat intelligence to target the entity's real attack surface. For ICT vendors: financial entities frequently must include their critical ICT providers in TLPT scope. Participating in a client TLPT exercise requires cooperation, pre-test scoping agreements, and often confidentiality arrangements with the testing team.

4. ICT Third-Party Risk Management (Articles 28–44)

This is the pillar most directly affecting ICT vendors. Financial entities must: (a) maintain a Register of ICT Third-Party Service Providers covering all providers, their services, and CIF designation; (b) ensure all ICT contracts meet DORA Article 30 minimum content requirements; (c) assess ICT concentration risk and document exposure to single providers; (d) implement exit strategies for all critical or important ICT relationships; and (e) conduct pre-contractual due diligence and ongoing monitoring. CTPPs designated by ESAs are subject to Lead Overseer authority, including the power to conduct onsite inspections and issue binding recommendations.

5. Information Sharing (Article 45)

DORA creates a voluntary framework for financial entities to share cybersecurity threat intelligence and vulnerability information with each other and with regulators through trusted information sharing arrangements. Participation is voluntary, and information shared is protected from liability under Article 45(3). ICT vendors may participate in these arrangements under contractual terms with their financial entity clients.

DORA Article 30 Contractual Checklist for ICT Vendors

Every ICT contract with an EU financial entity relating to a critical or important function must include the following provisions. If your current MSA lacks any of these, expect a contract amendment request from your financial clients:

• Complete description of all ICT services to be provided, including technical specifications
• Locations where ICT services are provided and where data is processed — with a change notification requirement
• Provisions ensuring availability, authenticity, integrity, and confidentiality of data (both personal and non-personal)
• Full service level descriptions including updates and performance thresholds
• Provisions for accessibility, continuity, and quality of ICT services across all conditions including crisis scenarios
• Audit rights: financial entity right to audit or have a third party audit the ICT vendor — including onsite inspections — with reasonable notice
• Termination rights and exit assistance obligations (minimum notice periods; transition support)
• ICT incident notification obligation: vendor must notify the financial entity without undue delay of incidents that may affect or are affecting the services — including preliminary assessments and updates
• Cooperation obligation with the financial entity's NCA and ESAs on request
• Subcontracting provisions — limitations on subcontracting; approval requirements for material subcontractors
• Data return and deletion obligations on contract termination

Practical note: EU financial entities received regulatory guidance in Q4 2024 to remediate non-compliant ICT contracts by January 2025. Many financial entities sent blanket contract amendment addendums to all ICT vendors. Failing to counter-sign or negotiate these addendums in good faith signals non-compliance with DORA obligations — which the financial entity must report to its NCA in its ICT Third-Party Register.

DORA and NIS2: How They Interact

NIS2 Directive (EU 2022/2555) and DORA create overlapping but distinct obligations. A bank affected by a major ICT incident may simultaneously need to: notify its NCA under DORA within 4 hours; notify its NIS2 competent authority within 24 hours (if it is also an essential entity under NIS2); and notify the relevant DPA under GDPR within 72 hours if personal data is involved. DORA Article 1(2) establishes lex specialis — for entities in scope of both DORA and NIS2, DORA's specific financial sector rules take precedence over NIS2 general requirements on identical subject matter.

ICT vendors to financial entities may also be subject to NIS2 in their own right — if they are classified as essential or important entities in sectors such as digital infrastructure, cloud computing services, or managed security service providers. CISOs at vendors serving EU financial entities should map both DORA contractual obligations (as ICT third-party providers) and NIS2 direct obligations (as potentially in-scope entities) simultaneously, since the control frameworks substantially overlap.

Frequently Asked Questions