Managing ICT Third-Party Risk Under DORA

What you need to know if you are a financial services institution using IT services

In this third article of our series on the EU's Digital Operational Resilience Act (DORA), we look at the requirements imposed on financial services institutions when procuring ICT services from third parties. This article is written from the perspective of the financial services institutions themselves. However, it will be followed by an article exploring what IT service providers should be doing to ensure that they are prepared for the regulation.

This article forms part of a series of articles we are publishing with our thoughts on each of the key topics covered by DORA. For an introduction to DORA, an overview of who is covered, and how the legislation interacts with other key cyber security laws, please see our article 'Dora is coming'. For an overview of the rules on incident management, classification and reporting, please see our article 'ICT incident management'.