For most of its history, contract management in financial services was a back-office discipline — negotiate the deal, file the agreement, renew on time. DORA ends that quietly comfortable era. Under the Digital Operational Resilience Act, the ICT contract manager becomes a named, front-line compliance role.

Why a regulation about cyber resilience lands on your desk

DORA — Regulation (EU) 2022/2554, fully applicable since 17 January 2025 — governs how EU financial entities manage technology risk. One of its five pillars, ICT Third-Party Risk Management, deals with the providers behind a financial entity's technology: cloud platforms, software vendors, data centres, managed services.

And here is the decisive fact: almost every Pillar 4 obligation is executed through a contract. The Register of Information is built from contract data. The mandatory security and audit rights are contract clauses. Exit strategies, sub-outsourcing controls, data-location terms — all contractual. When a supervisor inspects a financial entity's third-party risk management, the evidence they demand is, overwhelmingly, contractual evidence.

What this certification will make you able to do

Who this course is for

Contract managers, procurement and sourcing managers, vendor and supplier managers, outsourcing managers, and the legal counsel who support them — in banks, insurers, investment firms, payment institutions and any other DORA-scoped entity. It is equally relevant on the provider side: ICT vendors selling to EU financial entities must understand exactly what their clients are now contractually obliged to demand.