The supervisor
DORA requires a complete register of ICT contracts and timely reporting of major ICT incidents.
Industries · Financial services
Financial services: DORA, providers and contracts on one foundation.
Banks, insurers, payment and investment firms answer for ICT risk at board level. Paragraf keeps the register, the contracts, the incidents and the exit plans in one thread.
DORAGDPROutsourcingICT third-party risk
Exit plan · Nordpay
- OwnerHead of IT
- Next reviewMar 2027
- Approved byBoard
The pressure
Three directions at once.
The providers
Critical functions depend on a few ICT providers, and every contract must meet DORA's requirements.
The board
The management body holds final responsibility for ICT risk and must be able to show it.
Where teams start
The situations we see most in financial services.
A practical example
Example: onboarding a new ICT provider for payments.
Step 1 of 4
A new provider is proposed.
The business submits the request in a Form: service, function, data and criticality.
Request · Nordpay
- ServiceCard processing
- FunctionPayments · critical
- DataCustomer data
Step 2 of 4
The contract is checked against DORA.
Luis compares the draft with your DORA Playbook and lists what is missing.
Review · Nordpay
- Audit rightsIn place
- Exit strategyMissing
- Sub-outsourcingNeeds approval
Step 3 of 4
It enters the register.
When the contract is signed, the provider appears in the register of information with its Properties.
Register of information
- ProviderNordpay
- CriticalityCritical
- FunctionPayments
Step 4 of 4
An exit plan gets an owner.
The exit plan becomes an Obligation with a review date and an owner.
Exit plan · Nordpay
- OwnerHead of IT
- Next reviewMar 2027
- Approved byBoard
For the buying group
What each role gets.
One foundation, so each role sees its own part – and everyone sees the same truth.
- CRO / RiskCritical functions, providers and incidents in one view.
- ComplianceEvidence for the supervisor, collected where the work happens.
- General CounselDORA's contract requirements checked against every ICT contract.
- CIOOne register built from the contracts, not a spreadsheet beside them.
ICT risk the board can see, not just hear about.
Providers, contracts, incidents and exit plans in one place for the management body.
Before you decide
The questions that usually hold teams back.
Changing how work is followed up is a real decision. Here is how we make it a safe one.
Where do we start?
With one situation, not the whole organisation. We go through your systems and requirements together, set up the first flow with you, and then your teams build further on their own.
Do we have to change how we work?
No. Start from the contracts, templates and policies you already have. Paragraf takes over the follow-up – who does what, by when, and what proves it.
What happens to our data?
It stays yours. Everything follows your permissions, sensitive data is masked on the server and every change is logged. Ask us where data is stored and how export works – we answer in writing before you decide.
What if it isn't right for us?
Start with a limited first scope and clear acceptance criteria, agreed up front. You evaluate on your own data before you expand.
Go deeper
- Supplier contracts under NIS2 and DORAFind the gaps in what you have signed→
- Meet DORAICT contracts, register and exit plans in one place→
- Follow up what you've signedEvery obligation owned, dated and proven→
Next step
Fewer systems.
More control.
Book a walkthrough of your systems and requirements. We show you the thread from requirement to proof – with your own requirements.