DORA · pillar 5 of 5
Third-party risk — the register and the overseer
Every ICT contract in one register, mandatory clauses, and direct EU oversight of the biggest providers.
- 12 The register of information Entities must maintain and keep updated a register of information on all contractual arrangements for the use of ICT…
- 13 Clauses the contract has to contain Article 30 sets out mandatory contractual provisions for every ICT service contract — description of services and…
- 14 You have to be able to leave For ICT services supporting critical or important functions, entities must have exit strategies: documented plans and…
- 15 The EU supervises your cloud provider directly The ESAs designate critical ICT third-party providers (CTPPs) and place them under a direct EU oversight framework…
Start this pillar See the whole map
Read against Regulation (EU) 2022/2554 (DORA), Directive (EU) 2022/2555 (NIS2), Commission Delegated Regulation (EU) 2025/301 — RTS on major ICT-related incident reporting on . Regulations and frameworks change; the date is there so you can tell whether this has kept up.