DORA Certifications Bundle
399 € excl. VAT
Templates
DORA third-party risk: Article 30 clauses, register and exit strategies
Articles 28–44. Article 30 clause library with sample wording, Register of Information build guide, provider scoring matrix, exit playbooks by service type, hyperscaler negotiation playbook.
€69 excl. VAT
What this solves
Pillar 4 is the pillar that reaches outside your organisation, which is why it is the one that takes longest. Article 30 sets the contract clauses in two tiers: nine elements that every ICT services contract must contain, and six more where the service supports a critical or important function. Contracts signed before DORA were not drafted against that list, including the ones with providers who have no intention of renegotiating.
Alongside that sits the Register of Information, the exit strategy nobody has written, and the uncomfortable question of what you would do if a hyperscaler were unavailable for a week.
What is inside
- Article 30 clause library with sample wording: nine elements for every ICT contract, six more for critical or important functions
- Register of Information build guide on the 15 templates of ITS 2024/2956, with cross-template integrity checks
- Provider scoring & criticality classification matrix
- Exit playbooks by service type (SaaS / IaaS / outsourcing)
- Negotiation playbook for hyperscalers
- 15 KRIs for third-party portfolio monitoring
- CTPP impact assessment template
What it covers in the regulation
- Articles 28–30: managing ICT third-party risk
- Article 28(3): the Register of Information
- Article 30: key contractual provisions
- Articles 31–44: oversight of critical ICT third-party providers
- ITS (EU) 2024/2956: Register of Information templates
Who uses it, and when
Vendor management, procurement and legal teams, plus the ICT risk function that owns the concentration picture. Used during contract remediation, typically the longest workstream in a DORA programme.
How to work through it
- Classify which contracts support a critical or important function: every ICT contract carries the nine Article 30(2) elements, and those contracts carry the six 30(3) elements on top.
- Use the clause library to draft the amendments, starting with the providers most likely to agree.
- Build the Register from the ITS templates as you go, not as a separate project afterwards.
- Score providers with the matrix so concentration is visible rather than anecdotal.
- Write the exit playbook for each service type: the plan is the deliverable, not the intention.
Questions
Does it include actual clause wording?
Yes: sample wording for each of the fifteen Article 30 elements, the nine of Article 30(2) and the six of Article 30(3), to adapt to your contracts. It is not a checklist of clause topics.
Does it help with the Register of Information?
It includes the build guide. To fill and validate the register itself, the Register of Information Builder does that interactively.
Does it deal with hyperscalers?
There is a dedicated negotiation playbook for providers that will not accept bespoke terms.
What do I receive?
A PDF by personal download link, right after checkout.