DORA ICT Third-Party Risk: Contractual Requirements (Article 30) and Critical Providers

Programme Layers

• ICT third-party risk strategy and concentration analysis
• Register of information
• Due diligence and ongoing monitoring
• Contractual key terms (Article 30 themes)
• Exit / substitution plans for critical services

Critical ICT Third-Party Providers

Certain providers may be designated as Critical ICT Third-Party Providers and brought under ESA oversight. Financial entities still remain responsible for their own contractual and operational resilience duties even when a provider is designated.

Non-EU Vendors

Location outside the EU does not remove contractual or register obligations when services support in-scope financial entities. See DORA for ICT service providers.

How CyberSilo Helps

• Pillar-by-pillar evidence maps in CSA for DORA
• Detection and major-incident timelines with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Does Article 30 apply to every SaaS tool?

Article 30 key provisions target ICT services that support critical or important functions. Lower-criticality tools still need proportionate third-party risk handling and may appear in the register.

What is a CTPP?

A Critical ICT Third-Party Provider designated for Union-level oversight. Designation does not replace the financial entity’s own third-party risk duties.

Do we need audit rights in every contract?

Access, inspection, and audit themes are central Article 30 expectations for critical/important-function ICT services — negotiate them before signature, not after an examination letter.

Related DORA Resources

Hub · Pillars · CSA