DORA Certifications Bundle
399 € excl. VAT
Commission Delegated Regulation (EU) 2024/1773 & 2025/532
Digital Operational Resilience Act (DORA)
Objective: three texts govern your contracts with ICT third-party service providers. Keep them apart, because each one asks for something different:
Fundamental Principle: a financial entity that uses ICT services remains fully responsible, at all times, for compliance with and the discharge of all its obligations under DORA and applicable financial services law (Art. 28(1)(a)). Articles 28 to 30 address the financial entity, not the provider: the obligations reach the provider through your contract.
DORA Definition (Art. 3(19) and 3(21)): an undertaking providing ICT services, meaning digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, hardware as a service included. Typical examples:
ICT intra-group service providers count as ICT third-party service providers: the risks may differ, the requirements are the same (RTS 2024/1773, recital 5).
| Service Type | Covered by Articles 28 to 30? | Examples |
|---|---|---|
| ICT Services | Yes: the contract carries the Article 30 elements |
• Cloud computing • Software licensing • Infrastructure management • Cybersecurity services |
| Business services with ICT component | Assess: identify the ICT service within it |
• Business Process Outsourcing (BPO) with IT support • Consulting with IT deliverables • Audit with software tools |
| Pure business services | No: outside these articles |
• Strategic consulting • Legal services • Cleaning, physical security • Non-IT training |
Two tiers, set by the function the service supports. Article 30(2) lists nine elements, points (a) to (i), that every contract on the use of ICT services must include, whether or not the service supports a CIF. Article 30(3) adds six elements, points (a) to (f), where the service supports a CIF. A CIF contract therefore carries fifteen elements; every other ICT services contract carries nine.
Form (Art. 30(1)): the rights and obligations of both parties are set out in writing, and the full contract, service level agreements (SLAs) included, sits in one written document available on paper or in another downloadable, durable and accessible format.
Where the clauses come from: DORA Article 30 sets the elements itself. RTS 2024/1773 builds on it for CIF contracts: your policy specifies that they are in written form and include all the elements of Article 30(2) and (3) (Art. 8(1)), that they give you the right to access information, carry out inspections and audits and perform tests on ICT, with the audit methods you may use (Art. 8(2) and (3)), and that they set the measures and key indicators used to monitor the provider (Art. 9(1)).
What a missing element means: DORA does not declare the contract void. The obligation sits with the financial entity: a contract without an Article 30 element is the entity's own compliance gap, which its competent authority supervises. Close it by amending the contract; for a CIF contract, the policy requires material changes in a written document dated and signed by all parties (RTS 2024/1773, Art. 8(4)).
| Point | Element | Required in |
|---|---|---|
| 30(2)(a) | Description of all functions and ICT services; whether subcontracting of a CIF service is permitted, and on what conditions | Every ICT contract |
| 30(2)(b) | Locations of services and data, with advance notice of changes | Every ICT contract |
| 30(2)(c) | Availability, authenticity, integrity and confidentiality of data | Every ICT contract |
| 30(2)(d) | Access, recovery and return of data on insolvency, resolution, discontinuation or termination | Every ICT contract |
| 30(2)(e) | Service level descriptions, with updates and revisions | Every ICT contract |
| 30(2)(f) | Assistance on ICT incidents at no additional cost or at a cost set in advance | Every ICT contract |
| 30(2)(g) | Full cooperation with competent authorities and resolution authorities | Every ICT contract |
| 30(2)(h) | Termination rights and minimum notice periods | Every ICT contract |
| 30(2)(i) | Participation in ICT security awareness programmes and resilience training | Every ICT contract |
| 30(3)(a) | Full service levels with precise quantitative and qualitative targets | CIF contracts |
| 30(3)(b) | Notice periods and reporting obligations of the provider | CIF contracts |
| 30(3)(c) | Business contingency plans, tested, and ICT security measures | CIF contracts |
| 30(3)(d) | Participation and full cooperation in your TLPT | CIF contracts |
| 30(3)(e) | Ongoing monitoring: unrestricted access, inspection and audit | CIF contracts |
| 30(3)(f) | Exit strategy with a mandatory adequate transition period | CIF contracts |
Every contract on the use of ICT services carries these nine elements, whether or not the service supports a CIF.
What the text requires: a clear and complete description of all functions and ICT services the provider delivers, stating whether subcontracting of an ICT service supporting a CIF, or of material parts of it, is permitted and, when it is, the conditions that apply. For CIF services, RTS 2025/532 details those conditions (see below).
In practice, the description also records:
Practical example (Cloud Computing):
"The Provider supplies cloud infrastructure services (IaaS) to host the Bank's core banking application. Virtual servers are located in the Provider's datacentres in Paris (France) and Frankfurt (Germany). The guaranteed SLA is 99.95% monthly availability, with an API response time under 100 ms for 95% of requests. This service supports the Bank's critical function 'Banking Transaction Processing'. Subcontracting of this service is permitted only on the conditions set out in Schedule B."
What the text requires: the regions or countries where the contracted or subcontracted functions and ICT services are provided and where data is processed, including the storage location, and the provider's obligation to notify you in advance if it envisages changing those locations.
What DORA does not set: a minimum notice period, a right to refuse a change of location, or a rule that data stays in the EU/EEA. The length of the notice, and any right to object, are yours to negotiate: size them on the time you need to assess the change. Where personal data leaves the EU/EEA, the GDPR transfer rules (adequacy decision, standard contractual clauses) apply in their own right.
For CIF services, location is a factor your policy and risk assessment must weigh (RTS 2024/1773, Art. 1(c) and Art. 5(2)(g) and (h)). A provider established in a third country adds the checks of DORA Article 29(2): the insolvency law that would apply, compliance with Union data protection rules and the effective enforcement of the law in that country.
EU-only hosting vs. global hyperscalers
| Cloud Type | What to fix in the contract | Watch points |
|---|---|---|
| EU providers or EU-only regions |
• Listed countries and regions • Advance notice of any change |
• Support, backups and subcontractors must stay in the listed locations too • An EU location does not make a contract compliant: the Article 30 elements still apply |
| Hyperscalers (AWS, Azure, GCP) |
• Chosen regions and data-residency options • Advance notice of any change |
• Standard terms, negotiated through a DORA addendum • Exposure to third-country law (for example the US CLOUD Act) • Oversight by a Lead Overseer if the provider is a designated critical ICT third-party provider (CTPP): it does not change the clauses you need |
What the text requires:
How firms usually give point (c) its content. DORA sets no technical thresholds here. These are common contractual choices, to calibrate on your information security policy, which CIF contracts must be consistent with (RTS 2024/1773, Art. 3(6)(b)), not regulatory minimums:
Assurance you can ask the provider for:
Two rules frame this. You may only contract with providers that comply with appropriate information security standards and, for a CIF, you take due consideration of the most up-to-date and highest quality standards (DORA Art. 28(5)). Certifications and audit reports support your assurance on a CIF service, but you may not rely solely on them over time (RTS 2024/1773, Art. 8(3)).
What the text requires:
What the texts require: Article 30 sets no deadline for the provider to notify you of an incident. For a CIF contract, the contract sets notice periods and reporting obligations, including notification of any development that might materially affect the provider's ability to deliver the agreed service levels (30(3)(b)), and your policy ensures you are notified, where appropriate, of ICT-related incidents (RTS 2024/1773, Art. 9(2)(d)).
Content worth requiring in each notification:
Why the window matters: your own clock is short. For a major ICT-related incident, the initial notification to your competent authority is due as early as possible, within 4 hours of classifying the incident as major and no later than 24 hours after you became aware of it (RTS 2025/301, Art. 5). Set a contractual notification window that leaves you time to classify and report; its length is yours to negotiate.
What the text requires:
The termination rights you must be able to exercise (Art. 28(7)):
What DORA does not set: the length of the notice periods. Size them on the time you need to exit, and write them as minimums. For a CIF service, RTS 2025/532 adds termination cases linked to subcontracting (Art. 6).
Where the ICT service supports a CIF, the contract carries at least the six elements below in addition to the nine above. Settle the CIF question before you draft (Art. 28(4)(a)): a contract signed as non-CIF that turns out to support a CIF lacks these six elements and has to be renegotiated.
What the text requires:
Typical quantitative targets: availability (uptime %), performance (response time), support (response and resolution times), recovery time and recovery point. Your policy sets the measures and key indicators that monitor performance, and the measures that apply when service levels are missed, including contractual penalties where appropriate (RTS 2024/1773, Art. 9(1)).
What the text requires:
TLPT applies to the financial entities identified for it, but point (d) is an element of every CIF contract.
What the text requires: the right to monitor the provider's performance on an ongoing basis, which entails:
Organise, never limit. A notice mechanism can organise how the right is exercised (point (iv)); it cannot restrict it. You pre-determine the frequency and areas of audits on a risk basis, following commonly accepted audit standards (Art. 28(6)). Audit costs are a commercial term: DORA does not allocate them.
Audit methods (RTS 2024/1773, Art. 8(2) and (3)): your own internal audit or an appointed third party; where appropriate, pooled audits and pooled ICT testing with other clients of the same provider; third-party certifications and audit reports made available by the provider. The last two are allowed only under the conditions of Art. 8(3), which include a contractual right to perform individual and pooled audits at your discretion.
Microenterprises may agree that these rights are delegated to an independent third party appointed by the provider, keeping the right to request information and assurance from that third party at any time (Art. 30(3), final subparagraph).
If the provider refuses: for a CIF service, point (e) is not optional. Negotiate how the right is exercised (notice, pooled audits, alternative assurance where other clients' rights are affected), not whether it exists.
Example contractual wording:
"The Provider grants the Client, any third party appointed by the Client and the Client's competent authority unrestricted rights of access, inspection and audit of the premises, systems, data and documentation used to provide the Services, including the right to take copies of relevant documentation on-site. No other agreement or policy shall limit these rights. The Provider shall fully cooperate during on-site inspections and audits performed by the competent authorities, the Lead Overseer, the Client or its appointed third party. Schedule [X] sets out the scope, procedures and frequency of inspections and audits and how notice is given; notice arrangements organise the exercise of these rights and do not restrict it."
What the text requires: exit strategies, in particular a mandatory adequate transition period during which the provider keeps delivering the functions or ICT services, to reduce the risk of disruption or to ensure your effective resolution and restructuring, and which allows you to migrate to another provider or to an in-house solution consistent with the complexity of the service.
Around the clause: Article 28(8) requires exit strategies for every CIF service, and exit plans that are comprehensive, documented, sufficiently tested and reviewed periodically. RTS 2024/1773 (Art. 10) requires a documented exit plan for each contractual arrangement, reviewed and tested periodically, that takes into account unforeseen and persistent service interruptions, inappropriate or failed service delivery, and the unexpected termination of the contract. The plan must be realistic and feasible, with an implementation schedule compatible with the exit and termination terms of the contract.
What DORA does not set: the length of the transition period, or a timeframe for recovering data. Size both on the complexity of the service: the transition has to be long enough to migrate.
Worth writing into the transition clause:
Exit Plan checklist:
| Element | Required Details |
|---|---|
| Data inventory | Exhaustive list of all stored data, format, volume |
| Extraction procedure | Technical export method (API, DB dumps, file transfer) |
| Export format | Open and documented formats (CSV, JSON, XML, SQL) |
| Timeline | Transition schedule compatible with the contract's exit and termination terms |
| Migration tests | Export testing procedure before production |
| Support | Provider resources dedicated to transition |
| Data destruction | GDPR-compliant secure destruction certificate |
For a CIF service, Article 30(2)(a) requires the contract to say whether subcontracting is permitted and on what conditions. RTS 2025/532 turns that into contract terms:
See RTS 2025/532 below for complete subcontracting details
Not a contract clause. When you assess the risks of a CIF arrangement (Art. 28(4)(c)), Article 29(1) asks whether it would lead you to contract a provider that is not easily substitutable, or to hold multiple CIF arrangements with the same or closely connected providers. You weigh the benefits and costs of alternatives, such as using different providers.
Managing concentration risk:
Objective: specify what a financial entity determines and assesses when ICT services supporting critical or important functions, or material parts of them, are subcontracted (DORA Art. 30(5)). The RTS applies proportionately: size, risk profile, and the length and complexity of the chain of subcontractors are among the factors to take into account (Art. 1). In a group, the parent undertaking ensures the conditions are implemented consistently (Art. 2).
Before entering into the contract, decide whether the provider may subcontract a CIF service or material parts of it. Only sign where you have assessed that all of these conditions are met:
| Point | Condition |
|---|---|
| About the provider | |
| 3(1)(a) | Its due diligence lets it select and assess the operational and financial abilities of potential subcontractors, including their participation in your digital operational resilience testing when you require it |
| 3(1)(b) | It can identify all subcontractors of CIF services, notify and inform you of them, and give you the information this assessment needs |
| 3(1)(c) | Its contracts with those subcontractors let you comply with your own obligations under DORA and applicable law |
| 3(1)(d) | The subcontractor grants you and your competent and resolution authorities the same contractual rights of access and inspection as the provider does |
| 3(1)(e) | It has the ability, expertise and resources to monitor ICT risks at the level of its subcontractors |
| About you | |
| 3(1)(f) | You have the abilities, expertise and resources to monitor the ICT risks of the subcontracted service |
| 3(1)(g) | You have assessed the impact of a subcontractor failure on your digital operational resilience and financial soundness |
| 3(1)(h) | You have assessed the risks linked to the location of the potential subcontractors |
| 3(1)(i) | You have assessed ICT concentration risk at entity level under DORA Article 29 |
| 3(1)(j) | You have assessed any obstacle to the exercise of audit, inspection and access rights by competent authorities, resolution authorities or yourself |
Repeat the assessment in points (f) to (j) periodically, against changes in your business environment, ICT threats, concentration risk and geopolitical risk (Art. 3(2)). Relying on the provider's own assessment of its subcontractors does not limit your responsibility (Art. 3(3)).
The contract identifies which CIF services, or material parts of them, are eligible for subcontracting and under which conditions, and specifies that:
Contract changes needed to comply are implemented in a timely manner and as soon as possible, with a documented timeline (Art. 4(2)).
You may provide in the contract that it terminates where the provider:
Example subcontracting chain:
Every subcontractor that effectively underpins the CIF service must be identifiable (Art. 3(1)(b)), grant the same rights of access, inspection and audit (Art. 4(1)(j)) and appear in your Register of Information (ITS 2024/2956, templates B_05.01 and B_05.02).
DORA Obligation (Art. 28(3)): maintain and update, at entity level and at sub-consolidated and consolidated levels, a register of information on all contractual arrangements on the use of ICT services provided by ICT third-party service providers, distinguishing those that cover services supporting CIFs from those that do not. The register covers every ICT contract, not only the critical ones.
| Templates | What they record |
|---|---|
| B_01.01 to B_01.03 | The entity maintaining the register, the entities in the consolidation, and their branches outside the home country |
| B_02.01 to B_02.03 | The contractual arrangements: general and specific information, and the links between intra-group and external arrangements |
| B_03.01 to B_03.03 | Who signs: the entities receiving the services, the providers, and the entities providing services to others in the consolidation |
| B_04.01 | The entities making use of the ICT services |
| B_05.01 and B_05.02 | The direct providers and subcontractors, and the ICT service supply chain |
| B_06.01 | The identification of functions, including their criticality |
| B_07.01 | The assessment of the ICT services supporting a CIF |
| B_99.01 | The terminology and closed lists used to fill in the templates |
In practice, competent authorities collect the full register annually and pass it to the European Supervisory Authorities (ESAs); the first collection ran in spring 2025. Your competent authority sets the submission date: check it each year. Field-by-field guidance: Register of Information fields.
| Phase | Actions | Priority | When |
|---|---|---|---|
| Phase 1: Inventory |
☐ Inventory all current ICT providers and contracts ☐ Flag the services that support critical or important functions (RTS 2024/1773, Art. 3(2)) ☐ Identify contracts missing Article 30 elements |
Urgent | Now, then at each new contract |
| Phase 2: Contract Analysis |
☐ Legal review of each contract ☐ Gap analysis against Article 30(2) for every contract, and 30(3) for CIF contracts ☐ Prioritise renegotiations (CIF contracts first) |
Urgent | Now |
| Phase 3: Renegotiation |
☐ Contact each provider ☐ Negotiate contract amendments ☐ Obtain written, dated and signed amendments ☐ Plan B if refusal (change provider) |
High | At renegotiation, CIF contracts first |
| Phase 4: Register |
☐ Build the Register of Information on the 15 ITS templates ☐ Fill all required data ☐ Validate with Compliance/Risk ☐ Submit on your competent authority's date |
Urgent | At least yearly (Art. 28(3)) |
| Phase 5: Continuous Monitoring |
☐ Due diligence process for new providers (Art. 28(4)) ☐ Performance monitoring with the contract's key indicators (RTS 2024/1773, Art. 9) ☐ Subcontracting notification management (RTS 2025/532, Art. 5) ☐ Register kept up to date |
Ongoing | Permanent |
Challenge: Standardised contracts, limited flexibility
Strategies:
Challenge: Limited legal and compliance resources to take on your clauses
Strategies:
Our experts can guide your institution through DORA compliance, from gap analysis to full implementation.
Workbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.
Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.