All contracts with ICT third-party providers must be recorded in a register of information in a set format. The register is reported to supervisors and used to identify critical third-party providers across the EU.
What this means in practice
A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.
Key actions
- Collect all ICT contracts in one place
- Fill the register using the official templates
- Assign an owner to keep it current
Next steps
Data quality is the usual problem. Start with the contracts for critical functions. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.