DORA
The Digital Operational Resilience Act — who it binds, what it demands of your third-party arrangements, and where each obligation lives in Vendorica.
Regulation (EU) 2022/2554, the Digital Operational Resilience Act, has applied since 17 January 2025. It binds financial entities in the EU — banks, insurers, investment firms, payment institutions, crypto-asset service providers and a long list besides — and, through them, the ICT providers they depend on.
DORA is why most of our customers are here, and it is the regime this help centre covers in the most depth.
What DORA asks of your third parties
Section titled “What DORA asks of your third parties”Chapter V is the part most of this product answers.
- Keep a register of your ICT third-party arrangements (Article 28(3)) — a structured, complete inventory you can hand to your competent authority. See Registers of Information.
- Identify which arrangements support critical or important functions. This is the distinction the whole regime turns on: the obligations that follow are heavier for those arrangements.
- Get specific terms into your contracts (Article 30) — exit strategies, audit and access rights, sub-contracting conditions, service levels, incident assistance. Article 30(3) adds a longer list for arrangements supporting critical or important functions.
- Assess concentration and sub-contracting risk, including the fourth parties you reach through your direct suppliers.
- Test your operational resilience (Articles 24–25), and — for a subset of entities — carry out threat-led penetration testing.
Critical or important functions
Section titled “Critical or important functions”Two things are easy to conflate and are not the same:
- A function is critical or important if its disruption would materially impair your financial performance, your soundness, or your ability to meet your obligations under authorisation.
- A vendor carries a criticality tier, which is your internal risk banding.
Vendorica keeps these separate on purpose. A function’s critical-or-important status is a flag on the business function, not something derived from the supplier’s tier — because the regulation asks about the function, and a low-spend supplier can absolutely support a critical one. When you generate a register, it is the function’s flag that drives the obligation, not the vendor’s band.
Where it lives in Vendorica
Section titled “Where it lives in Vendorica”| DORA obligation | Where you do it |
|---|---|
| Register of ICT third-party arrangements (Art. 28(3)) | The vendor and contract registers, exported as a Register of Information |
| Critical-or-important determination | Business functions |
| Contractual requirements (Art. 30) | Contracts, with clause checks |
| Sub-contracting and fourth parties | The subprocessor register |
| Resilience testing (Arts. 24–25) | The resilience-testing programme |
| Information-sharing arrangements (Art. 45) | The information-sharing register |
Getting started with DORA
Section titled “Getting started with DORA”If DORA is why you are here, work in this order: classify your business functions first (which are critical or important?), then map the arrangements that support them, then check those contracts against Article 30. Doing it the other way round — starting from the supplier list — produces a register you cannot defend, because nothing in it explains why any given arrangement matters.