Regulation (EU) 2022/2554

DORA: digital operational resilience, the ICT register and third-party contracts

DORA has applied since 17 January 2025. It is often read as a cybersecurity requirement; in practice, the heaviest part of the work is ICT third-party risk and the contracts that carry it. The Regulation dictates what has to appear in every ICT service contract, which for most financial entities means reopening an entire contract portfolio. Sila builds the register first, because it is the register that identifies which contracts are concerned.

By Younès Lahrach, data protection specialist and external DPO, director of Sila International Advisory. First published on , last reviewed against the texts on .

Who is caught

Article 2 lists the financial entities covered by legal category: credit institutions, payment institutions, electronic money institutions, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, trade repositories, managers of alternative investment funds, management companies, insurance and reinsurance undertakings, insurance intermediaries, institutions for occupational retirement provision, credit rating agencies, administrators of critical benchmarks, crowdfunding service providers and securitisation repositories, among others.

It also covers ICT third-party service providers, which are subject to an oversight framework of their own under Chapter V Section II where they are designated as critical.

Article 16 provides a simplified risk-management framework for certain smaller entities, and Article 2(3) excludes a limited number of categories. Both have to be checked before concluding on the applicable regime.

Concrete obligations and deadlines

ICT risk management framework, Articles 5 to 15

An internal governance and control framework, placed under the responsibility of the management body, covering identification, protection, detection, response and recovery, business continuity and learning from incidents. Article 5(2) makes the management body responsible for defining, approving and overseeing it.

Register of information, Article 28(3)

A register of all contractual arrangements on the use of ICT services provided by third-party providers, maintained at entity level and, where applicable, at sub-consolidated and consolidated levels, distinguishing arrangements that cover critical or important functions from those that do not. Competent authorities may require it in full or in part.

Contractual clauses, Article 30

Article 30(2) lists the clauses required in every ICT service contract, and Article 30(3) adds a further set where the services support critical or important functions, including quantitative and qualitative performance targets, unlimited rights of access, inspection and audit, participation in threat-led penetration testing, and exit strategies with a mandatory transition period.

Incident classification and reporting, Articles 18 and 19

Classification of ICT-related incidents against the criteria in Article 18, and reporting of major incidents to the competent authority in three stages, the time limits being set by Article 5 of Delegated Regulation (EU) 2025/301: the initial notification as early as possible and in any case within four hours of the incident being classified as major, and no later than 24 hours from the moment the entity became aware of it; the intermediate report within 72 hours of the initial notification; and the final report no later than one month after the intermediate report or, where applicable, after its latest update.

Digital operational resilience testing, Articles 24 to 27

A testing programme proportionate to size and risk profile, with, for entities identified under Article 26, advanced threat-led penetration testing carried out at least every three years.

Penalties and competent authority

DORA does not set a single harmonised fine ceiling in the manner of the GDPR. Article 50 requires Member States to provide for appropriate administrative penalties and remedial measures, and lists the powers competent authorities must have at their disposal, including orders to cease conduct, cessation of practices, and public statements identifying the entity and the nature of the infringement. The level of penalty therefore follows from the sectoral national regime, which has to be checked.

Article 35 establishes a separate regime for critical ICT third-party service providers, under which the Lead Overseer may impose a periodic penalty payment of 1 % of the average daily worldwide turnover of the provider in the preceding business year, to compel compliance, for a period of up to six months.

The competent authority is the one that already supervises the entity under its sectoral regime.

How Sila engages

The order of operations is not negotiable: build the register of information under Article 28(3), classify the functions each contract supports as critical or important, and only then negotiate the clauses. A renegotiation started before classification imposes on every provider a regime the Regulation reserves for some.

The work then covers the preliminary assessment required by Article 28(4) before concluding an arrangement, the concentration risk analysis under Article 29, the exit strategies required by Article 28(7), and alignment of the Article 30 clauses with the Article 28 GDPR clauses in the same contract, so that the contract is reopened once rather than twice.

The method, in four steps

  1. 01Gap assessment

    Establishing whether, and on what basis, the instrument applies to the activity as it is actually carried out, then comparing what the instrument requires against what already exists inside the organisation. The assessment ends with a ranked list of gaps, not an overall score. An organisation that falls outside the scope learns so at this stage, and the engagement stops there.

  2. 02Mapping

    Recording what the measures will apply to: processing activities and data flows, systems, service providers, contracts in force, roles and responsibilities. The map is the working document for everything that follows, and it is the document produced to a supervisory authority in the event of an inspection.

  3. 03Technical and organisational measures

    Implementing the measures the mapping has shown to be necessary: internal procedures, policies, contractual clauses to be renegotiated with providers, governance decisions, and training for the people concerned. Measures that sit inside the information system are specified by Sila and implemented by your own teams or your IT provider.

  4. 04Evidence file

    Assembling the file that can be produced to a supervisory authority: records, impact assessments, dated and versioned policies, decision trails, proof of training. Compliance is not demonstrated by the absence of an incident but by the production of this file, which means it has to be kept current once the engagement ends.

A tailored quotation within 48 hours

The scope of an engagement cannot be guessed at: it depends on whether and how the instrument applies to you, on the number of processing activities, systems and contracts involved, and on what already exists inside your organisation. No amount is therefore published on this site.

The process starts with a scoping discussion, at no charge and without commitment, to define what the engagement will cover. A tailored quotation follows within 48 hours, setting out the scope, the deliverables and the amount.

Frequently asked questions

Which entities does DORA apply to?

Article 2 of Regulation (EU) 2022/2554 lists the financial entities covered by legal category, including credit institutions, payment and electronic money institutions, investment firms, crypto-asset service providers, insurance and reinsurance undertakings and intermediaries, fund managers, central securities depositories and trading venues. It also covers ICT third-party service providers, which are subject to a dedicated oversight framework where designated as critical. Article 16 provides a simplified framework for certain smaller entities.

What must the register of information contain?

Article 28(3) of Regulation (EU) 2022/2554 requires financial entities to maintain a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers, at entity level and, where applicable, at sub-consolidated and consolidated levels, distinguishing between arrangements that cover critical or important functions and those that do not. Competent authorities may request the complete register or specified sections of it.

Which clauses are mandatory in an ICT service contract?

Article 30(2) of Regulation (EU) 2022/2554 requires, in every such contract, a clear description of the functions and services, the locations of provision and data processing, data protection provisions, arrangements for access, recovery and return of data, service level descriptions, assistance in the event of an ICT incident, cooperation with competent authorities, termination rights and notice periods, and participation in security awareness programmes. Article 30(3) adds, for critical or important functions, performance targets, reporting duties, contingency plans, participation in threat-led penetration testing, unlimited rights of access, inspection and audit, and exit strategies.

Does DORA replace NIS2 for a financial entity?

For its ICT risk-management and incident-reporting obligations, in substance yes. Article 4 of Directive (EU) 2022/2555 provides that where sector-specific Union acts impose at least equivalent requirements, those provisions apply instead of the corresponding provisions of the Directive. This does not amount to a general exclusion: a group may include one entity falling under DORA and another falling under NIS2, and the check is made entity by entity.

What this regime triggers elsewhere

Article 4 of Directive (EU) 2022/2555 disapplies its own obligations in favour of an at least equivalent sector-specific act. That does not remove the need to check scope: an entity may fall under DORA for its financial activity and under NIS2 for another.

What NIS2 no longer requires of a financial entity

The same ICT contract must satisfy Article 30 of Regulation (EU) 2022/2554 and, where the provider processes personal data on behalf of the entity, Article 28(3) of Regulation (EU) 2016/679. Negotiating one without the other means reopening the contract twice.

Layering the Article 28 GDPR clauses

Whether DORA applies is determined by the nature of the entity under Article 2, which follows from the form chosen at the time of establishment. The decision is therefore taken before incorporation, not after.

Structuring a financial entity establishing in Europe

Reference texts

The information on this page is general in nature and does not constitute legal advice on a specific situation. Sila is not a law firm and does not provide representation before the courts.