Register of information (DORA) · Concepts · European Finance Observatory

Roles that need it

DORA (Digital Operational Resilience Act)DORA, Regulation (EU) 2022/2554, sets uniform rules on ICT risk management, ICT incident reporting, digital resilience testing and ICT third-party risk for almost all EU financial entities. It has applied since 17 January 2025 and also creates EU oversight of critical ICT third-party providers.
ICT third-party riskICT third-party risk is the risk to a financial entity from relying on external providers of information and communication technology services, such as cloud, software and data centres. DORA requires a strategy, due diligence, mandatory contract terms, monitoring, concentration analysis and exit plans for these arrangements.
Critical ICT third-party provider (CTPP)A critical ICT third-party provider is an ICT service provider, such as a large cloud company, that the European Supervisory Authorities designate under DORA because of its systemic importance to the financial sector. A lead overseer among the ESAs supervises it directly and can issue recommendations.
Outsourcing (EBA Guidelines)Outsourcing is an arrangement in which a service provider performs a process, service or activity that the institution would otherwise perform itself. The EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) set governance, risk assessment, contract and register rules, with stricter terms for critical or important functions.

Updated 31 Oct 2026.