A register you don't rebuild
The register comes from the contracts and their Properties, so it is current the day the auditor asks.
Solutions · Meet DORA
DORA starts in your ICT contracts. Keep them, and the register, in one place.
Your register of information, the contract requirements, critical functions and exit plans – linked to the contracts themselves, instead of rebuilt in a spreadsheet before every review.
DORARegister of informationICT third-party risk
Exit plan · CloudOps AB
- Last review2 Sep 2026
- Next review2 Mar 2027
- OwnerHead of IT
- Approved byBoard
Sound familiar?
Sound familiar?
“Our register of ICT contracts is a spreadsheet three people edit.”
“We can't see which contracts support critical functions.”
“The exit plans exist on paper, not in the contracts.”
Why now
DORA applies. The board answers for ICT risk.
DORA has applied across the EU since 17 January 2025. Financial entities must keep a register of information on all contracts with ICT third-party providers, and the management body holds the final responsibility for ICT risk – it cannot be delegated.
Source: Regulation (EU) 2022/2554 (DORA), articles 5 and 28.
Today's alternatives and what good looks like
How it is usually solved
- A spreadsheet registerRebuilt before every review, never in sync with the contracts.
- A contract archiveHolds the PDFs, not the requirements or the functions they support.
- A GRC tool on the sideKnows the risks, not the clauses that should cover them.
What good looks like
- The register is built from the contracts themselves.
- Every critical function shows its providers and clauses.
- Exit plans are reviewed on a schedule, with an owner.
How it runs in Paragraf
From ICT contract to a register you can stand behind.
Step 1 of 5
Build the register from the contracts.
ICT contracts in the Repository carry their Properties – provider, service, function and criticality. The register is a view, not a copy.
Register of information
- ICT contracts48
- Supporting critical functions11
- Missing criticality3
Step 2 of 5
Check the contract requirements.
Luis reviews each ICT contract against your Playbook for the DORA contract requirements and shows the clauses that are missing or weak.
Review · CloudOps AB
- Service levelsIn place
- Audit rightsIn place
- Exit strategyMissing
- Incident supportWeak
Step 3 of 5
Link contracts to critical functions.
Each critical function shows which providers and clauses it depends on, and which Controls cover the risk.
Function · Payments
- ProvidersCloudOps, Nordpay
- Controls4, all current
- Concentration1 provider for hosting
Step 4 of 5
Report major ICT incidents in time.
An incident Process with your reporting deadlines, owners and a log of every step – the same flow every time.
Incident · Card payments down
- ClassifiedMajor
- Initial reportSent
- Intermediate reportDue tomorrow
- OwnerCRO
Step 5 of 5
Keep exit plans alive.
Exit plans become Obligations with review dates and owners, linked to the contract and the function they protect.
Exit plan · CloudOps AB
- Last review2 Sep 2026
- Next review2 Mar 2027
- OwnerHead of IT
- Approved byBoard
What you get
Three things that change.
Clauses checked, not hoped for
Luis shows which contract requirements are covered and which are missing, with the clause as the source.
Board-level responsibility, visible
Critical functions, providers, incidents and exit plans in one view for the management body.
The register is ready the day the supervisor asks.
Built from the contracts themselves, so nobody rebuilds a spreadsheet the night before.
Before you decide
The questions that usually hold teams back.
Changing how work is followed up is a real decision. Here is how we make it a safe one.
Where do we start?
With one situation, not the whole organisation. We go through your systems and requirements together, set up the first flow with you, and then your teams build further on their own.
Do we have to change how we work?
No. Start from the contracts, templates and policies you already have. Paragraf takes over the follow-up – who does what, by when, and what proves it.
What happens to our data?
It stays yours. Everything follows your permissions, sensitive data is masked on the server and every change is logged. Ask us where data is stored and how export works – we answer in writing before you decide.
What if it isn't right for us?
Start with a limited first scope and clear acceptance criteria, agreed up front. You evaluate on your own data before you expand.
For the buying group
Everyone in the decision gets an answer.
A decision like this involves many people. This is what each of them can say when they bring it to the others.
- CEO“Management can see that we are in control – without asking around.”
- Compliance“I can show evidence to the auditor or supervisor whenever they ask.”
- CISO“It follows our permissions and gives one log for people, systems and AI.”
- General Counsel“Our legal risk goes down, and I can show it.”
- Procurement“Supplier terms, dates and reviews have owners, not reminders.”
Related
- Supplier contracts under NIS2 and DORAFind the gaps in what you have signed→
- Follow up what you've signedEvery obligation owned, dated and proven→
- Run supplier contracts end to endFrom request to signature to renewal→
Next step
Fewer systems.
More control.
Book a walkthrough of your systems and requirements. We show you the thread from requirement to proof – with your own requirements.