How to ensure third party vendors comply with DORA standards
The Digital Operational Resilience Act (DORA), which came into force in the EU in 2023, has changed how financial institutions must manage ICT risks - not only internally but across the entire supply chain. For Governance, Risk, and Compliance (GRC) professionals this likely means rethinking third party risk management (TPRM) to ensure that third party vendors meet the same stringent standards for digital resilience as internal operations. Under DORA, third parties’ operational resilience directly affects the financial entities they serve.
DORA mandates a holistic approach to digital risk, and non-compliance isn’t an option – leading to fines, regulatory scrutiny and jeopardising your organisation's ability to weather ICT disruptions. So let’s explore how you can proactively manage third party risk and align oversight with DORA’s expectations.
DORA and third party risk – what’s required?
As you’ll be aware, DORA’s unified regulatory framework includes obligations specifically related to third party ICT service providers. Key mandates include:
- Risk identification: Maintain a comprehensive and updated register of ICT third party dependencies.
- Contractual controls: Ensure all contracts with ICT providers include mandatory DORA-compliant clauses.
- Ongoing Monitoring: Implement continuous risk assessments and performance evaluations.
- Incident Management: Establish robust incident reporting and communication procedures.
- Exit Strategies: Develop termination and substitution plans for critical vendors.
- Failing to meet these standards could result in enforcement actions, reputational harm and increased exposure to ICT disruptions.
6 steps to ensure third party vendors comply with DORA standards
1. Establish a third party vendor inventory
Since an accurate vendor inventory is core to a DORA-aligned TPRM program, we suggest that you:
- Catalogue all ICT service providers, including cloud services, cybersecurity vendors, SaaS platforms, and data processors.
- Assess criticality, based on each vendor’s role in essential business functions and operational continuity.
- Determine concentration risk, particularly where services rely heavily on a small number of providers.
- Your inventory should be dynamic and updated regularly as contracts, services, or risk levels change.
2. Address contractual requirements under DORA
- To comply with Article 30 of DORA, you’ll need to embed specific provisions into your vendor agreements. These include:
- Clear SLAs tied to performance metrics and availability requirements.
- Audit and access rights for both the financial entity and regulators.
- Obligations for timely incident reporting, including major ICT-related events.
- Termination clauses and exit plans to ensure business continuity in case of disruption.
- A cross-functional approach involving legal, procurement, IT, and compliance is essential to standardise contract templates and enforce these clauses consistently.
3. Practice due diligence and continuous monitoring
Due diligence doesn’t end at onboarding - DORA expects financial institutions to actively monitor third party ICT risk. Best practices include:
- Initial risk assessments, covering security posture, regulatory history, and financial stability.
- Ongoing reviews of certifications (e.g., ISO 27001, SOC 2) and external audit results.
- Performance tracking, using KPIs and SLAs to identify service degradation or risk indicators.
- Automated TPRM tools, which provide real-time monitoring and alerts for emerging vendor risks.
- These recommendations allow you to detect and address vulnerabilities before they escalate.
4. Test third party resilience
DORA emphasises proactive testing to assess operational resilience. This applies not just to internal systems but also to third party services. GRC teams should:
- Conduct joint tabletop exercises, simulating cyberattacks, outages, or data breaches.
- Test recovery capabilities, including failover systems and backup procedures.
- Review business continuity and disaster recovery plans of key vendors.
- Test results should be documented, evaluated, and integrated into risk mitigation strategies.
5. Prioritise incident reporting and escalation
Timely incident reporting is essential to DORA compliance. You’ll need to ensure that vendors:
- Understand their obligations for reporting incidents that affect the financial entity.
- Have defined escalation paths and contact points for urgent communication.
- Participate in post-incident reviews, providing transparency into root causes and remediation.
- Clear reporting thresholds and incident severity classifications should be codified in contracts and operational procedures.
6. Stay aligned with regulatory developments
DORA implementation will continue to evolve through guidance from the European Supervisory Authorities (ESAs). To remain compliant, we recommend that you:
- Monitor Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS) updates.
- Regularly review and update policies, risk frameworks, and vendor assessment tools.
- Engage in industry forums and leverage peer benchmarks to stay ahead of regulatory expectations.
- The thinking is that a proactive compliance posture helps ensure long-term resilience and avoids costly remediation.
Trust Decision Focus to ensure your third party vendors comply with DORA standards
Remember, the resilience of your third parties is your resilience too! Did you know that Decision Focus has a solution designed to meet DORA’s prescriptive requirements, including those around third party compliance?
Read more about our award-winning, modular, no code SaaS GRC platform specifically tailored for financial institutions to address DORA requirements - including ICT risk, incident management, resilience testing, third party risk, and intelligence sharing.
Alternatively download our DORA brochure or to see our solution put through its paces, by booking a demo now.
