You remain fully responsible for risks that come from ICT providers, and you need a strategy for managing them. DORA expects a third-party risk strategy, due diligence before contracts, ongoing monitoring and exit plans for critical services.
Why it matters
For DORA, third-party risk is rarely a purely technical question. It touches ownership, budget and how quickly decisions can be made when something goes wrong. Teams that agree on these points in advance spend less time debating them under pressure.
What to check
- Approve a third-party risk strategy
- Assess providers before signing and during the contract
- Write exit plans for critical ICT services
Where to start
Concentration risk matters. Note where many critical services depend on the same provider. Write down what you decide, who owns it and when it will be reviewed. That record is often the evidence a reviewer asks for later.