DORA Testing and Third-Party Risk — Articles 24–30

Regulation (EU) 2022/2554 (DORA) gives the obligations on this page in two Chapters. Chapter IV, “Digital operational resilience testing”, contains Articles 24 to 27. Chapter V, “Managing of ICT third-party risk”, has two Sections. Section I (Articles 28 to 30) gives the “Key principles for a sound management of ICT third-party risk”. Section II (Articles 31 to 44) gives the Oversight Framework of critical ICT third-party service providers. Articles 24 to 30 give obligations to the financial entity.

Article 2(1), point (u), puts ICT third-party service providers in the scope of DORA. An ICT third-party service provider is also a financial entity where Article 2(1), points (a) to (t), apply to it (Article 2(2)). For DORA Article 3, see Article 3 on the page on scope and governance.

Articles 24–25 — digital operational resilience testing

DORA Article 24(1) gives a testing program obligation to financial entities other than microenterprises. For financial entities of Article 16(1), see the section on the testing program. Article 24(1) gives the primary obligation:

1. For the purpose of assessing preparedness for handling ICT-related incidents, of identifying weaknesses, deficiencies and gaps in digital operational resilience, and of promptly implementing corrective measures, financial entities, other than microenterprises, shall, taking into account the criteria set out in Article 4(2), establish, maintain and review a sound and comprehensive digital operational resilience testing programme as an integral part of the ICT risk-management framework referred to in Article 6.

DORA Article 24(2) to (6) give the contents of the testing program:

• Article 24(2): the testing program includes “a range of assessments, tests, methodologies, practices and tools to be applied in accordance with Articles 25 and 26”.
• Article 24(3): financial entities, other than microenterprises, use a risk-based approach. They examine the criteria of Article 4(2), the changes in ICT risk, the risks of the financial entity, and “the criticality of information assets and of services provided”. They also examine “any other factor the financial entity deems appropriate”.
• Article 24(4): financial entities, other than microenterprises, make sure that “tests are undertaken by independent parties, whether internal or external”. For an internal tester, the financial entity must “dedicate sufficient resources”. It must also make sure that it prevents conflicts of interest “throughout the design and execution phases of the test”.
• Article 24(5): financial entities, other than microenterprises, have procedures and policies “to prioritise, classify and remedy all issues revealed throughout the performance of the tests”. They also “establish internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed”.
• Article 24(6): financial entities, other than microenterprises, make sure, “at least yearly”, that “appropriate tests are conducted on all ICT systems and applications supporting critical or important functions”.

DORA Article 25 gives the tests:

• Article 25(1): the testing program “shall provide, in accordance with the criteria set out in Article 4(2), for the execution of appropriate tests”. Examples are “vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing”. The financial entity can also use other tests.
• Article 25(2): central securities depositories and central counterparties “shall perform vulnerability assessments before any deployment or redeployment of new or existing applications and infrastructure components, and ICT services supporting critical or important functions of the financial entity”.
• Article 25(3): microenterprises do the tests of Article 25(1) “by combining a risk-based approach with a strategic planning of ICT testing”. They balance “the scale of resources and the time to be allocated to the ICT testing” against “the urgency, type of risk, criticality of information assets and of services provided, as well as any other relevant factor, including the financial entity’s ability to take calculated risks”.

Article 24(1) and Article 24(3) to (6) do not apply to microenterprises. Threat-led penetration testing (Article 26) is a different obligation, and it applies only to some financial entities (see the Articles 26–27 section of this page).

The testing program and the financial entities of Article 16(1)

DORA does not tell financial entities if the Article 24 testing program applies to the financial entities of Article 16(1), first subparagraph, that are not microenterprises. These provisions are related to this point:

• Article 24(1) gives the testing program to “financial entities, other than microenterprises”. It makes the testing program “an integral part of the ICT risk-management framework referred to in Article 6”.
• Article 16(1), first subparagraph, tells financial entities that “Articles 5 to 15 of this Regulation shall not apply to” the financial entities that it names. Article 6 is one of these Articles.
• Article 26(1) on TLPT and Article 28(2) on the strategy on ICT third-party risk do not apply to two groups. These groups are the financial entities of Article 16(1), first subparagraph, and microenterprises. Article 24(1) names only microenterprises.
• Article 16(1), point (g), tells the financial entities of Article 16(1) to “test, on a regular basis, the plans and measures referred to in point (f), as well as the effectiveness of the controls implemented in accordance with points (a) and (c)”. Delegated Regulation (EU) 2024/1774, Title III, gives more rules. Article 36 of that Regulation gives an ICT security testing plan. Article 40(1) tells these financial entities to test their business continuity plans “at least once every year for the back-up and restore procedures, or upon every major change of the business continuity plan”.
• Recital 43 tells financial entities that the financial entities of the simplified ICT risk management framework “should not be required” to do some tasks. Two of these tasks are to “expand the testing of business continuity and response and recovery plans to capture switchover scenarios between primary ICT infrastructure and redundant facilities” and to “establish a comprehensive digital operational resilience testing programme as an integral part of the ICT risk management framework provided for in this Regulation”. A recital helps to read the Articles, but it does not give obligations.

Article 16(1), point (g), applies to all financial entities of Article 16(1). For a financial entity of Article 16(1) that is not a microenterprise, it is not clear if Article 24 applies. If your organization is such a financial entity, speak with the competent authority about Article 24. For their other obligations, see Article 16 on the page on scope and governance.

Articles 26–27 — threat-led penetration testing (TLPT)

In DORA Article 3(17), threat-led penetration testing (TLPT) is “a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems”. Article 26(1) gives the obligation:

1. Financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, which are identified in accordance with paragraph 8, third subparagraph, of this Article, shall carry out at least every 3 years advanced testing by means of TLPT. Based on the risk profile of the financial entity and taking into account operational circumstances, the competent authority may, where necessary, request the financial entity to reduce or increase this frequency.

Thus a financial entity must do TLPT only if all of these conditions apply:

• It is not a financial entity of Article 16(1), first subparagraph.
• It is not a microenterprise.
• The competent authority identifies it through Article 26(8), third subparagraph.

DORA Article 26(8), third subparagraph, tells the competent authorities to identify the financial entities “taking into account the criteria set out in Article 4(2)”. The competent authorities make this decision on “an assessment of the following”: “impact-related factors”, “possible financial stability concerns”, and the “specific ICT risk profile, level of ICT maturity of the financial entity or technology features involved”.

Delegated Regulation (EU) 2025/1190, Article 2, gives the criteria for the identification:

• Article 2(1): the TLPT authorities examine each financial entity on “impact-related and systemic character related factors” and on “ICT risk-related factors”.
• Article 2(2): the TLPT authorities “shall require all of the following financial entities to perform TLPT”. This does not apply if “the assessment referred to in paragraph 1 in respect of a financial entity indicates that its impact, the financial stability concerns relating to that financial entity, or its ICT risk profile, does not justify the performance of a TLPT”. These are the financial entities:
  • Credit institutions identified as “global systemically important institutions (G-SIIs)” or “other systemically important institutions (O-SIIs)”, or that are part of a G-SII or O-SII (point (a)).
  • Payment institutions with more than EUR 150 billion of total value of payment transactions “in each of the 2 calendar years preceding the assessment by the TLPT authority” (point (b)).
  • Electronic money institutions with more than EUR 150 billion of total value of payment transactions, or more than EUR 40 billion of outstanding electronic money, in each of those 2 years (point (c)).
  • Central securities depositories and central counterparties (points (d) and (e)).
  • Trading venues with an electronic trading system, if the criteria of point (f) apply to them.
  • Insurance undertakings and reinsurance undertakings, if the criteria of point (g) apply to them.
• Article 2(3): this applies “Where more than one financial entity belonging to the same group and sharing ICT systems, or where more than one financial entity using the same ICT intra-group service provider, meet the criteria set out in paragraph 2”. Then the TLPT authorities make a decision if “the requirement to perform TLPT on an individual basis is relevant” for these financial entities.

In that Regulation, a TLPT authority is one of these authorities (Article 1, point (7)):

• The single public authority of DORA Article 26(9).
• An authority with TLPT tasks from DORA Article 26(10).
• A competent authority of DORA Article 46.

DORA Article 26(2) to (10) give the other rules for TLPT:

• Article 26(2): each test includes “several or all critical or important functions of a financial entity” and occurs “on live production systems supporting such functions”. The financial entity must identify “all relevant underlying ICT systems, processes and technologies” for these functions, also when ICT third-party service providers supply them. The financial entity identifies which functions the test must include, and that scope “shall be validated by the competent authorities”.

• Article 26(3): if the test includes ICT third-party service providers, the financial entity makes sure that they are part of the test. The financial entity “shall retain at all times full responsibility for ensuring compliance with this Regulation”.

• Article 26(4): pooled testing is possible only on one condition. The “participation of an ICT third-party service provider in the TLPT” must be “reasonably expected to have an adverse impact on the quality or security of services delivered by the ICT third-party service provider to customers that are entities falling outside the scope of this Regulation, or on the confidentiality of the data related to such services”. Then the financial entity and the ICT third-party service provider “may agree in writing” that the ICT third-party service provider makes a contract directly with an external tester.

  The pooled testing occurs “under the direction of one designated financial entity”. It includes the ICT services supporting critical or important functions that the financial entities get from that ICT third-party service provider. It counts as the TLPT of each financial entity that is part of it. These rules are “Without prejudice to paragraph 2, first and second subparagraphs”.

  For pooled testing, the financial entities stay “at all times fully responsible for the impact of the tests” (Article 26(7)).

• Article 26(5): the financial entity, with the ICT third-party service providers and the testers, must “apply effective risk management controls to mitigate the risks of any potential impact on data, damage to assets, and disruption to critical or important functions”.

• Article 26(6) and (7): the test ends “after reports and remediation plans have been agreed”. Then the financial entity gives the authority of Article 26(9) or (10) “a summary of the relevant findings, the remediation plans and the documentation”. Where applicable, the external testers also give these items. The authorities give an attestation. “The financial entity shall notify the relevant competent authority of the attestation, the summary of the relevant findings and the remediation plans.”

  Delegated Regulation (EU) 2025/1190, Article 13(1): the financial entity must give the remediation plans and documentation of DORA Article 26(6) to these authorities:

  • The TLPT authority.
  • The financial entity’s competent authority, where different.

  The financial entity must give these items “within 8 weeks from the notification referred to in Article 12(7)” of that Regulation.

• Article 26(8), first subparagraph: if a financial entity uses internal testers, it “shall contract external testers every three tests”.

• Article 26(8), second subparagraph: “Credit institutions that are classified as significant in accordance with Article 6(4) of Regulation (EU) No 1024/2013, shall only use external testers”.

• Article 26(9) and (10): a Member State can designate a single public authority for TLPT in the financial sector. If it does not, a competent authority can give some or all TLPT tasks of Articles 26 and 27 to “another national authority in the financial sector”. The competent authority continues to identify the financial entities that must do TLPT.

DORA Article 27(1) gives five requirements for testers. A financial entity uses only testers to which all of these requirements apply:

• (a) They “are of the highest suitability and reputability”.
• (b) They “possess technical and organisational capabilities and demonstrate specific expertise in threat intelligence, penetration testing and red team testing”.
• (c) They “are certified by an accreditation body in a Member State or adhere to formal codes of conduct or ethical frameworks”.
• (d) They give “an independent assurance, or an audit report, in relation to the sound management of risks associated with the carrying out of TLPT”.
• (e) They “are duly and fully covered by relevant professional indemnity insurances, including against risks of misconduct and negligence”.

DORA Article 27(2) adds three conditions for internal testers. The competent authority, or the single public authority of Article 26(9) and (10), gave approval for their use. The competent authority examined that the financial entity has “sufficient dedicated resources” and prevents conflicts of interest. The threat intelligence provider is external to the financial entity.

Article 27(3) tells the financial entity to make sure that its contracts with external testers “require a sound management of the TLPT results”. The financial entity must also make sure that “any data processing thereof” does not cause risks to it. This includes “any generation, store, aggregation, draft, report, communication or destruction”.

DORA Article 26(11) tells the ESAs, “in agreement with the ECB”, to prepare the regulatory technical standards “in accordance with the TIBER-EU framework”. The result is Delegated Regulation (EU) 2025/1190.

Article 28 — ICT third-party risk and the register of information

DORA gives “requirements in relation to the contractual arrangements concluded between ICT third-party service providers and financial entities” (Article 1(1), point (b)). Article 28, “General principles”, gives the obligations of the financial entity for ICT third-party risk. Article 28(1) tells financial entities to “manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1)”. Article 28(1) has two points:

• (a) A financial entity that uses contractual arrangements for ICT services “shall, at all times, remain fully responsible for compliance with, and the discharge of, all obligations under this Regulation and applicable financial services law”.
• (b) The financial entity works on ICT third-party risk “in light of the principle of proportionality”. It examines the “nature, scale, complexity and importance of ICT-related dependencies” and the risks of the contractual arrangements, “at individual and at group level”.

DORA Article 28(4) to (8) give the obligations before and during a contractual arrangement:

• Article 28(4): before a contractual arrangement on the use of ICT services, the financial entity must do all of these tasks:
  • Examine if the contractual arrangement includes ICT services supporting critical or important functions.
  • “Assess if supervisory conditions for contracting are met”.
  • Identify and examine “all relevant risks” of the contractual arrangement. These include the ICT concentration risk of Article 29.
  • “Undertake all due diligence on prospective ICT third-party service providers”.
  • Identify and examine the conflicts of interest of the contractual arrangement.
• Article 28(5): a financial entity uses only ICT third-party service providers “that comply with appropriate information security standards”. For critical or important functions, the financial entity gives “due consideration” to “the most up-to-date and highest quality information security standards” before it signs the contractual arrangement.
• Article 28(6): “In exercising access, inspection and audit rights over the ICT third-party service provider”, the financial entity must use a risk-based approach. It must “pre-determine the frequency of audits and inspections as well as the areas to be audited”. It must use “commonly accepted audit standards in line with any supervisory instruction on the use and incorporation of such audit standards”. For contractual arrangements with “high technical complexity”, it makes sure that its auditors “possess appropriate skills and knowledge”.
• Article 28(7): the financial entity makes sure that it can terminate the contractual arrangements in each of the conditions of points (a) to (d). For example, these conditions include a “significant breach” by the ICT third-party service provider, or a condition in which “the competent authority can no longer effectively supervise the financial entity”.
• Article 28(8): for ICT services supporting critical or important functions, the financial entity must have exit strategies. When it prepares exit strategies, the financial entity must “take into account” risks at the ICT third-party service provider, for example “a possible failure on their part”. It must also “take into account” termination of the contractual arrangements in the conditions of Article 28(7). The financial entity must be able to exit without “disruption to their business activities”, without “limiting compliance with regulatory requirements”, and without “detriment to the continuity and quality of services provided to clients”. Its exit plans must be “comprehensive, documented” and, with the criteria of Article 4(2), “sufficiently tested and reviewed periodically”. The financial entity also identifies alternative solutions, and it has transition plans and contingency measures.

DORA Article 5(3) also tells financial entities, other than microenterprises, to “establish a role” to monitor these contractual arrangements or to “designate a member of senior management” (Article 5 on the page on scope and governance). Article 5 does not apply to the financial entities of Article 16(1).

DORA Article 28(2) does not apply to the financial entities of Article 16(1), first subparagraph. Article 28(1), Article 28(3) to (9), Article 29, and Article 30 do not name these financial entities. But Article 28(1) refers to the ICT risk management framework “as referred to in Article 6(1)”. Article 28(2) and (3) start with “As part of their ICT risk management framework”. Article 16(1) tells financial entities that Articles 5 to 15 do not apply to these financial entities.

DORA does not tell financial entities how Article 28(1) and (3) apply to the financial entities of Article 16(1). If your organization is a financial entity of Article 16(1), speak with the competent authority about Article 28(1) and (3).

Article 28(2) — strategy on ICT third-party risk

DORA Article 28(2) gives the obligation for a strategy on ICT third-party risk:

2. As part of their ICT risk management framework, financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, shall adopt, and regularly review, a strategy on ICT third-party risk, taking into account the multi-vendor strategy referred to in Article 6(9), where applicable. The strategy on ICT third-party risk shall include a policy on the use of ICT services supporting critical or important functions provided by ICT third-party service providers and shall apply on an individual basis and, where relevant, on a sub-consolidated and consolidated basis. The management body shall, on the basis of an assessment of the overall risk profile of the financial entity and the scale and complexity of the business services, regularly review the risks identified in respect to contractual arrangements on the use of ICT services supporting critical or important functions.

The strategy on ICT third-party risk, which includes the policy, “shall apply on an individual basis and, where relevant, on a sub-consolidated and consolidated basis”.

Delegated Regulation (EU) 2024/1773 gives “the detailed content of the policy regarding contractual arrangements on the use of ICT services supporting critical or important functions provided by ICT third-party service providers”. DORA Article 28(10) tells the ESAs to prepare these regulatory technical standards.

DORA Article 5(2), point (h), also tells the management body to “approve and periodically review the financial entity’s policy on arrangements regarding the use of ICT services provided by ICT third-party service providers”. Article 5 is part of the ICT risk management framework of Articles 5 to 15. Thus, it does not apply to the financial entities of Article 16(1).

Article 28(3) — register of information

DORA Article 28(3) tells financial entities to “maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers”. Article 28(3) also gives these obligations:

• “The contractual arrangements referred to in the first subparagraph shall be appropriately documented, distinguishing between those that cover ICT services supporting critical or important functions and those that do not.”
• Financial entities “shall report at least yearly to the competent authorities on the number of new arrangements on the use of ICT services, the categories of ICT third-party service providers, the type of contractual arrangements and the ICT services and functions which are being provided”.
• When the competent authority tells them to, financial entities give “the full register of information or, as requested, specified sections thereof”. They also give “any information deemed necessary to enable the effective supervision of the financial entity”.
• Financial entities tell the competent authority “in a timely manner” about “any planned contractual arrangement on the use of ICT services supporting critical or important functions as well as when a function has become critical or important”.

Implementing Regulation (EU) 2024/2956 gives the standard templates for the register of information. Its Article 3(1) tells financial entities to use “the templates set out in Annex I to IV”. DORA Article 28(9) tells the ESAs to prepare these standard templates.

The registers of information also have a function in the Oversight Framework. In DORA Article 31(10), the competent authorities send the reports of Article 28(3), third subparagraph, to the Oversight Forum “on a yearly and aggregated basis”. The Oversight Forum examines “the ICT third-party dependencies of financial entities” for the designation of critical ICT third-party service providers.

Article 29 — ICT concentration risk

DORA Article 29, “Preliminary assessment of ICT concentration risk at entity level”, adds to Article 28(4), point (c). Article 29(1) tells financial entities to examine if “the envisaged conclusion of a contractual arrangement in relation to ICT services supporting critical or important functions would lead to” one of these results:

• (a) The financial entity contracts “an ICT third-party service provider that is not easily substitutable”.
• (b) The financial entity has “multiple contractual arrangements” for ICT services supporting critical or important functions with the same ICT third-party service provider, or “with closely connected ICT third-party service providers”.

The financial entity must “weigh the benefits and costs of alternative solutions, such as the use of different ICT third-party service providers”.

DORA Article 29(2) gives four obligations for contractual arrangements on ICT services supporting critical or important functions:

• The contractual arrangements can let the ICT third-party service provider subcontract these ICT services to other ICT third-party service providers. Then the financial entity must “weigh benefits and risks that may arise in connection with such subcontracting, in particular in the case of an ICT subcontractor established in a third-country”.
• The financial entity must examine “the insolvency law provisions that would apply in the event of the ICT third-party service provider’s bankruptcy”. It must also examine “any constraint that may arise in respect to the urgent recovery of the financial entity’s data”.
• If the ICT third-party service provider is in a third country, the financial entity must also examine “the compliance with Union data protection rules and the effective enforcement of the law in that third country”.
• If subcontracting is permitted in the contractual arrangements, the financial entity must examine if “potentially long or complex chains of subcontracting may impact their ability to fully monitor the contracted functions”. It must also examine the effect on “the ability of the competent authority to effectively supervise the financial entity”.

Article 30 — Key contractual provisions

DORA Article 30 gives the minimum contents of each contractual arrangement on the use of ICT services. Article 30(1) tells the financial entity and the ICT third-party service provider that their rights and obligations “shall be clearly allocated and set out in writing”. The full contract includes the service level agreements. It is “documented in one written document which shall be available to the parties on paper, or in a document with another downloadable, durable and accessible format”. Article 30(1) applies to the full contract, and it is not an obligation only on subcontracting.

DORA Article 30(2) gives the items that all contractual arrangements on the use of ICT services must include:

• (a) “A clear and complete description of all functions and ICT services to be provided by the ICT third-party service provider”. The contract tells if subcontracting “of an ICT service supporting a critical or important function, or material parts thereof, is permitted and, when that is the case, the conditions applying to such subcontracting”.
• (b) The locations, “namely the regions or countries, where the contracted or subcontracted functions and ICT services are to be provided and where data is to be processed, including the storage location”. The ICT third-party service provider must tell the financial entity before it changes these locations.
• (c) “Provisions on availability, authenticity, integrity and confidentiality in relation to the protection of data, including personal data”.
• (d) “Provisions on ensuring access, recovery and return in an easily accessible format of personal and non-personal data processed by the financial entity in the event of the insolvency, resolution or discontinuation of the business operations of the ICT third-party service provider, or in the event of the termination of the contractual arrangements”.
• (e) Service level descriptions, “including updates and revisions thereof”.
• (f) The obligation of the ICT third-party service provider to help the financial entity with an ICT incident that is related to the ICT service. This help is “at no additional cost, or at a cost that is determined ex-ante”.
• (g) The obligation of the ICT third-party service provider “to fully cooperate with the competent authorities and the resolution authorities of the financial entity, including persons appointed by them”.
• (h) “Termination rights and related minimum notice periods for the termination of the contractual arrangements, in accordance with the expectations of competent authorities and resolution authorities”.
• (i) “The conditions for the participation of ICT third-party service providers in the financial entities’ ICT security awareness programmes and digital operational resilience training in accordance with Article 13(6)”.

DORA Article 30(3) adds these items for contractual arrangements on the use of ICT services supporting critical or important functions:

• (a) Full service level descriptions “with precise quantitative and qualitative performance targets within the agreed service levels”. With these performance targets, the financial entity can monitor the ICT services. The performance targets also “enable appropriate corrective actions to be taken, without undue delay, when agreed service levels are not met”.
• (b) “Notice periods and reporting obligations of the ICT third-party service provider to the financial entity”. These include the notification of “any development that might have a material impact on the ICT third-party service provider’s ability to effectively provide the ICT services supporting critical or important functions in line with agreed service levels”.
• (c) Requirements for the ICT third-party service provider “to implement and test business contingency plans and to have in place ICT security measures, tools and policies that provide an appropriate level of security for the provision of services by the financial entity in line with its regulatory framework”.
• (d) “The obligation of the ICT third-party service provider to participate and fully cooperate in the financial entity’s TLPT as referred to in Articles 26 and 27”.
• (e) The right to monitor the performance of the ICT third-party service provider “on an ongoing basis”. This right has four parts:
  • (i) “Unrestricted rights of access, inspection and audit by the financial entity, or an appointed third party, and by the competent authority”, and the right to “take copies of relevant documentation on-site if they are critical to the operations of the ICT third-party service provider”.
  • (ii) “The right to agree on alternative assurance levels if other clients’ rights are affected”.
  • (iii) The obligation of the ICT third-party service provider to “fully cooperate during the onsite inspections and audits performed by the competent authorities, the Lead Overseer, financial entity or an appointed third party”.
  • (iv) “The obligation to provide details on the scope, procedures to be followed and frequency of such inspections and audits”.
• (f) Exit strategies, “in particular the establishment of a mandatory adequate transition period”. In this transition period, the ICT third-party service provider continues to supply the functions or ICT services. The financial entity can then change to a different ICT third-party service provider or to “in-house solutions”.

The last subparagraph of DORA Article 30(3) gives a different rule for point (e). A microenterprise and its ICT third-party service provider can agree that the rights of access, inspection and audit of the microenterprise go to “an independent third party, appointed by the ICT third-party service provider”. The microenterprise can then get “information and assurance” on the performance of the ICT third-party service provider from that third party “at any time”.

DORA Article 30(4) tells financial entities and ICT third-party service providers to “consider the use of standard contractual clauses developed by public authorities for specific services”. This applies “When negotiating contractual arrangements”.

Article 30(5) — subcontracting

DORA gives the obligations of the financial entity on subcontracting in Article 29(2) and in Article 30(2), points (a) and (b). For these obligations, see the Article 29 section and the Article 30 section of this page. Article 30(5) tells the ESAs to prepare regulatory technical standards on the items of Article 30(2), point (a), “which a financial entity needs to determine and assess when subcontracting ICT services supporting critical or important functions”.

Delegated Regulation (EU) 2025/532 is the result. It applies to ICT services supporting critical or important functions, and to “material parts thereof”:

• Article 3(1): before it signs a contractual arrangement, the financial entity makes a decision if the ICT third-party service provider can subcontract these ICT services. The financial entity signs only after it examines that “all of the following conditions have been complied with” in points (a) to (j). For example, point (a) gives this condition:

  the due diligence processes on the ICT third-party service provider ensure that it is able to select and assess the operational and financial abilities of potential ICT subcontractors to provide the ICT services that support critical or important functions or material parts thereof, including by participating, when required to do so by the financial entity, in digital operational resilience testing as referred to in Chapter IV of Regulation (EU) 2022/2554;

  Points (d) and (i) give two other conditions for the financial entity to examine. In point (d), “the subcontractor grants the financial entity and competent and resolution authorities the same contractual rights of access and inspection as those granted by the ICT third-party service provider”. In point (i), the financial entity must have examined the “ICT concentration risks at entity level in accordance with Article 29”.

• Article 3(2) applies if a financial entity uses ICT third-party service providers that subcontract “ICT services that support critical or important functions or material parts thereof”. The financial entity must do the risk assessment of Article 3(1), points (f) to (j), again at regular intervals “against possible changes in their business environment”. Article 3(3): If it uses the risk assessment of its ICT third-party service provider, the financial entity keeps its “final responsibility” for its obligations.

• Article 4: the contractual arrangement identifies the ICT services that the ICT third-party service provider can subcontract, and on which conditions. The contract contains the items of points (a) to (l). For example, the ICT third-party service provider “is responsible for the provision of the services provided by the subcontractors” and must “monitor all subcontracted ICT services”. The financial entity has “the right to terminate the contract” when the conditions of Article 6 of that Regulation, or of DORA Article 28(7), apply (point (l)).

• Article 5: the ICT third-party service provider tells the financial entity about “any intended material changes to its subcontracting arrangements well in time”. The contractual arrangement contains “a reasonable notice period” for the financial entity “to approve or object to the changes”. The ICT third-party service provider makes the changes only after the financial entity “has either approved or not objected to the changes by the end of the notice period”. Article 5(4) applies if the financial entity finds that the material changes “exceed the financial entity’s risk tolerance”. Before the notice period ends, the financial entity must:

  • Tell the ICT third-party service provider about that assessment.
  • Object to the changes and “request modifications to those changes before they are implemented”.

• Article 6: the financial entity “shall have the right to provide” in the contractual arrangement that the contract stops in each of these conditions:

  • (a) “the financial entity has objected to material changes to the subcontracting arrangements supporting critical or important functions and requested for modifications to those arrangements, but the ICT third-party service provider has nevertheless implemented those material changes”.
  • (b) “the ICT third-party service provider has implemented material changes to subcontracting arrangements supporting critical or important functions or material parts thereof before the end of the notice period without approval by the financial entity”.
  • (c) “the ICT third-party service provider subcontracts an ICT service that supports a critical or important function or material part thereof not explicitly permitted to be subcontracted by the contract”.

Articles 31 to 44 — Oversight Framework for critical ICT third-party service providers

DORA Chapter V, Section II, gives “rules for the establishment and conduct of the Oversight Framework for critical ICT third-party service providers when providing services to financial entities” (Article 1(1), point (c)). Article 31(1) tells the ESAs, through the Joint Committee and on the recommendation of the Oversight Forum, to do these two tasks:

• (a) Designate “the ICT third-party service providers that are critical for financial entities”.
• (b) Appoint a Lead Overseer for each critical ICT third-party service provider.

In DORA Article 31(2), the ESAs must use “all of the following criteria” for the designation:

• (a) The systemic impact on “the stability, continuity or quality of the provision of financial services” if the ICT third-party service provider “would face a large scale operational failure to provide its services”. This criterion includes “the number of financial entities and the total value of assets of financial entities” that the ICT third-party service provider supplies.
• (b) “The systemic character or importance of the financial entities that rely on the relevant ICT third-party service provider”.
• (c) “The reliance of financial entities on the services provided by the relevant ICT third-party service provider in relation to critical or important functions”, “directly or indirectly, through subcontracting arrangements”.
• (d) The degree of substitutability of the ICT third-party service provider.

If the ICT third-party service provider is part of a group, the ESAs apply the criteria to the ICT services of “the group as a whole” (Article 31(3)). The Lead Overseer tells the ICT third-party service provider “the outcome of the assessment”. The ICT third-party service provider can send “a reasoned statement” to the Lead Overseer “Within 6 weeks from the date of the notification” (Article 31(5)). After the designation, the ESAs tell the critical ICT third-party service provider the date from which the oversight starts. That date is “no later than one month after the notification”. The critical ICT third-party service provider tells the financial entities that it supplies about its designation.

In DORA Article 31(8), the designation does not apply to these four groups:

• (i) Financial entities that supply ICT services to other financial entities.
• (ii) ICT third-party service providers in oversight frameworks for the tasks of Article 127(2) of the Treaty on the Functioning of the European Union.
• (iii) ICT intra-group service providers.
• (iv) ICT third-party service providers “providing ICT services solely in one Member State to financial entities that are only active in that Member State”.

DORA Article 32 gives the Oversight Forum, and Article 34 gives the Joint Oversight Network of the three Lead Overseers. Articles 33 and 35 to 44 give the tasks of the Lead Overseer and the “Powers of the Lead Overseer”. These include a “Request for information”, “General investigations”, “Inspections”, and recommendations.

The Lead Overseer must adopt an “individual oversight plan” for each critical ICT third-party service provider (Article 33(4)). The “individual oversight plan” must give “the annual oversight objectives and the main oversight actions planned”. The Lead Overseer must send it to that critical ICT third-party service provider “yearly”.

The Lead Overseer imposes periodic penalty payments on a critical ICT third-party service provider on the conditions of Article 35(6) to (8). For the maximum value and the time limits, see Penalties and enforcement.

Designated critical ICT third-party service providers

DORA Article 31(9) tells the ESAs, through the Joint Committee, to “establish, publish and update yearly the list of critical ICT third-party service providers at Union level”. The press release of the ESAs of 18 November 2025 came with the list of designated critical ICT third-party service providers. It names 19 critical ICT third-party service providers. Thus, always read the list of designated critical ICT third-party service providers from ESMA.

Obligations of financial entities in the Oversight Framework

The ESAs and the Lead Overseers do the designation and the oversight. But DORA also gives these obligations to the financial entity:

• Article 31(12): a financial entity can “make use of the services of an ICT third-party service provider established in a third country and which has been designated as critical” only if that critical ICT third-party service provider “has established a subsidiary in the Union within the 12 months following the designation”.
• Article 42(3): the competent authorities tell the financial entities about “the risks identified in the recommendations” of the Lead Overseer to critical ICT third-party service providers. The financial entities must include these risks in their work on ICT third-party risk.
• Article 42(4): a competent authority can find that a financial entity does not include these risks, or does not “sufficiently address” them. Then the competent authority tells the financial entity that a decision is possible “within 60 calendar days of the receipt of such notification”. The decision is possible “in the absence of appropriate contractual arrangements aiming to address such risks”.
• Article 42(6): “as a measure of last resort”, the competent authority can tell the financial entity to “temporarily suspend, either in part or completely, the use or deployment of a service provided by the critical ICT third-party service provider”. This continues until the risks “have been addressed”. “Where necessary”, the competent authority can also tell the financial entity to “terminate, in part or completely, the relevant contractual arrangements”.
• Article 42(8): for this decision, the competent authority examines the criteria of points (a) to (f). An example is the risk for “continuity of the financial entity’s business operations”. The competent authority gives the financial entity “the necessary period of time” to adjust its contractual arrangements and to use its exit strategies and transition plans.

The designation of an ICT third-party service provider does not change the obligations of the financial entity in Articles 28 to 30. The financial entity stays “fully responsible” for compliance (Article 28(1), point (a)). In Modulos, the Requirement ORF-384 includes Articles 31(12) and 42.

These Articles in Modulos

In Modulos, the Organization Framework OFF-16 "DORA" and the AI System Framework MFF-16 "DORA" contain the Requirements for DORA Articles 24 to 30. For each Requirement, its provisions, and the page for the law, see Requirements of the DORA Frameworks.

Where to go next

For DORA and other EU laws, see NIS2 and DORA and the EU AI Act and DORA.

DORA overview

The dates of DORA, its sources, and the penalties

Applicability and governance

Articles 1, 2, 4, 5, 6, 16: scope, the management body, and the two frameworks

ICT risk and resilience operations

Articles 7–23: the ICT risk management framework and ICT-related incidents

Information sharing and Level 2 acts

Article 45 and the eight Commission Regulations for DORA

NIS2 vs DORA

Where each law applies, and NIS2 Article 4

Sources of this page

• DORA — Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 “on digital operational resilience for the financial sector” (OJ L 333, 27.12.2022, p. 1). Articles 1(1), 2(1), 2(2), 3(17), 5(2), 5(3), 16(1), 24 to 35, 42, and recital 43. EUR-Lex.
• Delegated Regulation (EU) 2024/1773 of the Commission of 13 March 2024, “specifying the detailed content of the policy regarding contractual arrangements on the use of ICT services supporting critical or important functions provided by ICT third-party service providers”. OJ L, 2024/1773, 25.6.2024. EUR-Lex.
• Delegated Regulation (EU) 2024/1774 of the Commission of 13 March 2024, “specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework”. OJ L, 2024/1774, 25.6.2024. Title III, Articles 36 and 40. EUR-Lex.
• Implementing Regulation (EU) 2024/2956 of the Commission of 29 November 2024, “with regard to standard templates for the register of information”. OJ L, 2024/2956, 2.12.2024. Article 3 and Annexes I to IV. EUR-Lex.
• Delegated Regulation (EU) 2025/532 of the Commission of 24 March 2025, on subcontracting of ICT services supporting critical or important functions. OJ L, 2025/532, 2.7.2025. Articles 3 to 6. EUR-Lex.
• Delegated Regulation (EU) 2025/1190 of the Commission of 13 February 2025, on threat-led penetration testing. OJ L, 2025/1190, 18.6.2025. Articles 1, 2, and 13. EUR-Lex.
• ESAs — the list of designated critical ICT third-party service providers in DORA Article 31(9). The press release of the ESAs of 18 November 2025. See the list of designated critical ICT third-party service providers and the press release.

Disclaimer

This page gives general information. It is not legal advice. DORA applies directly in all Member States. The obligations come from DORA and from the Commission Regulations for DORA. The competent authorities that DORA Article 46 names make sure that financial entities comply. Before you make a decision, read DORA and the Commission Regulations on EUR-Lex, and speak with a lawyer.