DORA in practice: what the third-party register reveals
In plain words: A new EU law makes financial firms list every computer supplier they rely on, and making the list shows how hard it is to say what depends on what. Resilience and regulation, explained simply
In short
- The EU's Digital Operational Resilience Act, DORA, has applied to financial entities since 17 January 2025. One of its plainest demands is a register of every contract for ICT services.
- Building that register shows something most organisations in any sector would find too: the link between a business service, the systems behind it and the contracts that keep them running is rarely written down in one place.
- The register is worth having even where no regulator asks for it, because it answers the question every outage raises: who else depends on this supplier?
What the register is
Article 28 of DORA requires financial entities to keep a register of information on all their contractual arrangements for ICT services. A Commission implementing regulation, (EU) 2024/2956, sets out the templates: who the provider is, what service it supplies, which functions it supports, whether those functions are critical or important, where data is processed, and which subcontractors sit behind it.
The registers are not only for the firm. Supervisors collected them, and the European Supervisory Authorities used that data to designate the first critical ICT third-party providers, published in November 2025. Those providers now face oversight of their own. In other words, the register is how regulators see concentration across a whole sector.
What it reveals
My own view, from watching organisations build similar inventories: the hard part is not listing suppliers. Procurement already has that list. The hard part is three joins that nobody owns.
- Contract to service. Which business services stop if this contract fails? Procurement knows the contract, operations knows the service, and the two lists use different names.
- Supplier to subcontractor. The software provider runs on a cloud provider, which uses a content delivery network. The real dependency may be two steps down and in nobody's contract.
- Critical function to everything. Deciding which functions are critical or important forces a conversation about what the organisation would actually need to keep running on a bad day.
Why it matters outside finance
In July 2024 a faulty CrowdStrike update crashed about 8.5 million Windows devices, by Microsoft's estimate. Airlines, hospitals, broadcasters and retailers all found out at once how much ran on one product. Organisations that already knew where it was deployed, and which services sat on those machines, recovered faster because they knew where to look.
That is the register's job in any sector. DORA makes it a legal duty for financial firms; for everyone else it is simply good practice.
What to do on Monday
- Take your ten most important services and, for each, list the suppliers it cannot run without.
- For each of those suppliers, ask who they depend on in turn. Note the names that appear more than once.
- Agree with procurement and operations on one identifier per service, so contracts and incidents can be joined.
- Pick the one supplier whose failure would hit the most services and check that there is a plan for it.
Sources
- Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Article 28.
- Commission Implementing Regulation (EU) 2024/2956, standard templates for the register of information (2024).
- ESMA, European Supervisory Authorities designate critical ICT third-party providers (November 2025).
- Microsoft, Helping our customers through the CrowdStrike outage (July 2024).
Personal work and my own view, not my employer's. Sources are public.