ICT third-party risk

Roles that need it

• Operational Risk Analyst
• Service Delivery Manager (Outsourcing & Shared Services)
• Cyber Risk Consultant (Banking)
• IT Auditor
• Regulatory Change Analyst

Skills it belongs to

• Third party risk management and outsourcing rules
• Operational resilience and ICT risk rules (DORA and equivalents)
• Vendor and service contract management

Related concepts

• DORA (Digital Operational Resilience Act)DORA, Regulation (EU) 2022/2554, sets uniform rules on ICT risk management, ICT incident reporting, digital resilience testing and ICT third-party risk for almost all EU financial entities. It has applied since 17 January 2025 and also creates EU oversight of critical ICT third-party providers.
• Register of information (DORA)The register of information is the inventory that every financial entity must keep under Article 28 of DORA of all its contractual arrangements for ICT services with third-party providers, flagging those that support critical or important functions. Supervisors collect it in a standard format set by implementing technical standards.
• Outsourcing (EBA Guidelines)Outsourcing is an arrangement in which a service provider performs a process, service or activity that the institution would otherwise perform itself. The EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) set governance, risk assessment, contract and register rules, with stricter terms for critical or important functions.
• Critical ICT third-party provider (CTPP)A critical ICT third-party provider is an ICT service provider, such as a large cloud company, that the European Supervisory Authorities designate under DORA because of its systemic importance to the financial sector. A lead overseer among the ESAs supervises it directly and can issue recommendations.

Sources

• Regulation (EU) 2022/2554 (Digital Operational Resilience Act), EUR-Lex (external site) accessed 31 Oct 2026

Updated 31 Oct 2026.