Knowledge · DORA · Article 28
Know every ICT provider – and how to leave them.
Financial entities must manage ICT third-party risk as part of their ICT risk-management framework: keep a register of all contractual arrangements, assess providers before signing and have exit strategies for critical or important functions.
What it requires
In plain words.
- ICT third-party risk is part of the ICT risk-management framework
- A register of information on all contractual arrangements with ICT providers
- Yearly reporting of new arrangements to the competent authority
- Assessment before entering an arrangement, including concentration risk
- Exit strategies for ICT services supporting critical or important functions
- Right to terminate the contract in defined situations
Plain-language summary of DORA Article 28 (Regulation (EU) 2022/2554). Not legal advice – read the official text on EUR-Lex.
In practice
What it takes.
The register is only useful if it stays current. That means connecting it to the contracts themselves – not keeping a separate spreadsheet next to them.
- RegisterThe register of information, built from your actual contracts
- ProcessPre-contract assessment with concentration risk and approval
- Exit plansExit strategy per critical or important function, with an owner
- ReportingThe yearly report drawn from the register, not rebuilt by hand
How it runs in Paragraf – on the same foundation as your contracts and processes.
Next step
See DORA article 28
with your own requirements.
Book a walkthrough. We show you the thread from this article to the Control, the owner and the evidence – in your own setup.