DORA Register of Information: Template and How to Complete It

Why Supervisors Care

The register underpins concentration-risk analysis, subcontracting visibility, and Critical ICT Third-Party Provider oversight. Incomplete or stale registers are a common examination finding.

Field Themes to Capture

• Provider legal identity and contact points
• Services / functions supported and criticality (critical or important functions)
• Locations of data processing / storage and subcontracting chains
• Contract identifiers, dates, and governing law
• Substitution / exit feasibility notes
• Links to due diligence and monitoring evidence

Operating Cadence

• Update on contract change, new critical function, or material subcontracting
• Quarterly completeness review before any supervisory request window
• Reconcile against CMDB / SaaS spend / legal contract vault

How CyberSilo Helps

• Pillar-by-pillar evidence maps in CSA for DORA
• Detection and major-incident timelines with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Is the register only for cloud providers?

No. It covers ICT third-party service arrangements broadly — including non-cloud ICT services that support critical or important functions.

Who owns the register day to day?

Typically joint ownership: ICT risk / CISO for criticality, procurement for commercial data, legal for contract facts, with a single accountable executive.

Can we keep it in a spreadsheet forever?

Spreadsheets fail under version control and multi-entity reporting. Move to a controlled system with audit trail before the next supervisory request.

Related DORA Resources

Hub · For ICT providers · Checklist