DORA for ICT Service Providers (Including Non-EU Vendors): What Your Bank Clients Will Ask

Provider Readiness Checklist

• Map which client functions your service supports (critical / important vs supporting)
• Prepare a standard DORA contract schedule (audit rights, subcontracting, resilience SLAs)
• Document processing locations and sub-processors
• Evidence packs: access control, logging, incident notification to the client, backup/restore tests
• Exit assistance runbooks (data return / deletion timelines)

Non-EU Vendors

EU financial entities still must meet DORA when outsourcing to you. Expect flow-down requirements and longer due-diligence cycles. Being outside the EU does not remove contractual obligations your clients must impose.

CyberSilo as an ICT Provider

CyberSilo provides SIEM/SOC and compliance automation services to financial clients. We maintain DORA-aligned contractual and operational artefacts so clients can evidence third-party risk without reinventing questionnaires each year.

How CyberSilo Helps

• Pillar-by-pillar evidence maps in CSA for DORA
• Detection and major-incident timelines with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Does DORA regulate me directly if I am only a SaaS vendor?

ICT third-party service providers are within Article 2(1)(u). Most day-to-day pressure arrives via client contracts and possible CTPP designation for critical providers.

Will clients demand on-site audits?

Access, inspection, and audit themes are expected for critical/important-function services. Negotiate practical remote/onsite protocols early.

What about incident notification to the bank?

Clients need timely notice to meet their own major-incident clocks — build customer notification SLAs that fit the 4-hour / 72-hour / 1-month chain.

Related DORA Resources

Hub · Applicability · CSA