European UnionDORA, Articles 28-30 (ICT Third-Party Risk Management)
Regulation (EU) 2022/2554, Arts. 28-30
In force since .
A sector security regimes rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Obligation class
- Governance, Security
What it requires
- This duty binds you as the financial entity contracting for an ICT service, not the ICT third-party service provider directly, though the provider's own obligations enter through the contract terms Article 30 requires you to include; it reaches you where you are a financial entity under Article 2(1), points (a) to (t), of Regulation (EU) 2022/2554, unless Article 2(3) takes you out of the Regulation (among others, insurance and reinsurance undertakings referred to in Article 4 of Directive 2009/138/EC, institutions for occupational retirement provision with no more than 15 members in total, insurance intermediaries that are microenterprises or small or medium-sized enterprises, and post office giro institutions) or your Member State has excluded you under Article 2(4).
- Manage ICT third-party risk as an integral, proportionate component of your ICT risk management framework, and, unless you are a microenterprise or an entity covered by Article 16(1), adopt and regularly review a strategy on ICT third-party risk.NIST CSF 2.0GV.SC-01
- Maintain and update a register of all your ICT services contracts, distinguishing those supporting a critical or important function, report on it at least yearly to your competent authority, and produce it in full on the authority's request.NIST CSF 2.0ID.AM-04
- Before entering into an ICT services contract, assess whether it supports a critical or important function, whether supervisory conditions for contracting are met, and the concentration risk under Article 29, including whether the provider is easily substitutable and whether you already rely on it, or a closely connected provider, for other critical functions.NIST CSF 2.0GV.SC-06
- Put every ICT services contract in writing in one document, covering at minimum the functions and locations involved, data-protection and access-on-termination provisions, service levels, the provider's duty to assist you on an incident and to cooperate with your regulators, termination rights, and your security-awareness programme.NIST CSF 2.0GV.SC-05
- For a contract supporting a critical or important function, add quantitative service level targets, an unrestricted right to monitor, inspect and audit the provider, the provider's cooperation in your threat-led penetration testing, and an exit strategy with a mandatory transition period. If you are a microenterprise, you and the provider may agree that your access, inspection and audit rights are delegated to an independent third party the provider appoints.NIST CSF 2.0GV.SC-05NIST CSF 2.0GV.SC-10
These lines are LexLint's reading of the law's text. Also read by: European Banking Authority, Single Rulebook Questions and Answers tool, answer to question 2024_7290 on the definition and scope of ICT services in Article 3(21) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.IM-P2Owners or operators (e.g., the organization or third parties such as service providers, partners, customers, and developers) and their roles with respect to the systems/products/services and components (e.g., internal or external) that process data are inventoried.
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- NIST CSF 2.0
- GV.SC-01A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- GV.SC-06Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
- GV.SC-10Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement
- ID.AM-04Inventories of services provided by suppliers are maintained
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
The competent authority designated for each category of financial entity under Article 46 (for example the entity's banking, payments, investment-firm, or insurance supervisor), or the ECB for a credit institution classified as significant under Regulation (EU) No 1024/2013, exercising the administrative penalty and remedial powers of Articles 50 and 51. A critical ICT third-party service provider is overseen separately, by the Lead Overseer under Chapter V, Section II.
Settledness
- As of
- Guidance link
- https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7290
- Guidance body
- European Banking Authority, Single Rulebook Questions and Answers tool, answer to question 2024_7290 on the definition and scope of ICT services in Article 3(21)
- Open questions
- Which services of a payment scheme or payments infrastructure operator are digital and data services provided through ICT systems on an ongoing basis within Article 3(21), and so fall under Articles 28 to 30, given the answer that not all services provided by payment card schemes are ICT services?
Also on the record
EEA status
- Annex
- IX
- Status
- Incorporated
- Force date
- Joint committee decision number
- 40/2025
- Source link
- https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:22025D0770
- Decision date
What this law does
Article 28 requires a financial entity to manage ICT third-party risk as an integral component of its ICT risk management framework, proportionate to the nature, scale, complexity and criticality of its ICT-related dependencies.
Article 28(2) requires the entity, other than a microenterprise or one covered by Article 16(1), to adopt and regularly review a strategy on ICT third-party risk, and Article 28(3) requires it to maintain and update a register of information on all its ICT services contracts, distinguishing those supporting a critical or important function, report on the register at least yearly to its competent authority, and produce it in full on request.
Article 28(4) requires the entity, before entering into a contractual arrangement, to assess whether it covers a critical or important function, whether supervisory conditions for contracting are met, the risks the arrangement poses including the concentration risk Article 29 describes, and to undertake due diligence on the prospective provider and to identify and assess any conflicts of interest the arrangement may cause.
Article 29 is that preliminary assessment of ICT concentration risk: whether the provider is easily substitutable, whether the entity already has multiple critical-function contracts with the same or a closely connected provider, where subcontracting is possible, the benefits and risks of it, in particular for an ICT subcontractor established in a third country, and the risk a long or complex subcontracting chain poses to the entity's ability to monitor the function and to the competent authority's ability to supervise it; for any contract supporting a critical or important function it also requires the entity to consider the insolvency law provisions that would apply if the provider became bankrupt and any constraint on the urgent recovery of its data, and, for a provider established in a third country, compliance with Union data protection rules and the effective enforcement of the law in that country.
Article 30(1) and (2) require every ICT services contract to be in writing, in a single document, and to cover at minimum a description of the functions and services provided, the locations where the service and any subcontracted part of it will run and where data will be processed, provisions on the availability, authenticity, integrity and confidentiality of data including personal data, the entity's right to access, recover and return its data if the provider becomes insolvent or the contract ends, service level descriptions, the provider's duty to assist the entity on an ICT incident, the provider's duty to cooperate with the entity's competent and resolution authorities, termination rights and notice periods, and the provider's participation in the entity's security awareness and training programme.
Article 30(3) requires a contract supporting a critical or important function to add, on top of those elements, quantitative and qualitative service level targets, notice of anything that could materially affect the provider's ability to perform, the provider's duty to implement and test business contingency plans and to have in place ICT security measures, tools and policies, the provider's cooperation in the entity's threat-led penetration testing, the entity's right to monitor the provider's performance on an ongoing basis, with unrestricted rights of access, inspection and audit, and an exit strategy with a mandatory transition period letting the entity move to another provider or bring the function in-house.
A microenterprise and its provider may agree that the entity's rights of access, inspection and audit are delegated to an independent third party the provider appoints.
When LexLint raises it
When your app profile says your app provides financial services.
Back to the example · Lint your app
Page updated .