YTYK You think you know

Card 14 of 15 Third-party risk — the register and the overseer ●●○ Working knowledge

You have to be able to leave

For ICT services supporting critical or important functions, entities must have exit strategies: documented plans and transition arrangements that let them exit without disrupting business, breaching regulatory requirements, or losing continuity and quality of service.

Why it is like this

A dependency you cannot leave is not a supplier relationship, it is a single point of failure with an invoice. Requiring a tested way out is the only control that works against lock-in.

Not to be confused with

A termination clause. A clause says you may leave; an exit strategy says where the function would run instead, how the data gets there, how long it takes and who does it.

In practice

The uncomfortable test: if the provider failed tomorrow, or was designated critical and ordered to change something you depend on, what happens on Monday?

Source: Regulation (EU) 2022/2554 (DORA) — Art. 28(8). Read on .

Odd one out Check yourself

Three of these are part of an exit strategy as DORA describes it. Which one is not enough on its own?

  1. A transition plan to move the function to an alternative provider
  2. Arrangements to exit without breaching regulatory requirements
  3. Arrangements to exit without disrupting business continuity or service quality
  4. A termination-for-convenience clause with 90 days' notice
Show the answer

A termination-for-convenience clause with 90 days' notice

The right to leave and the ability to leave are different things, and DORA requires the second.