Home›DORA Vendor Management
For EU/EEA financial institutions under DORA

DORA Vendor Management:
Your ICT Third-Party Register Starts Here

DORA Article 28 requires every financial institution to maintain a complete ICT third-party register, conduct documented due diligence, and produce evidence on demand. VendorAuditly gives you all of this at $49/month — no GRC consultant, no enterprise contract.

Build your DORA ICT register → What DORA requires
DORA vendor management in one sentence
DORA requires financial institutions to know which ICT vendors they use, assess each vendor’s risk, document that assessment, and produce the evidence to regulators when asked. VendorAuditly automates all four steps — register, assessment, documentation, and export.
Scope

Does DORA apply to your organisation?

DORA (Digital Operational Resilience Act, Regulation EU 2022/2554) became effective on 17 January 2025. It applies to a wide range of financial entities operating in the EU and EEA.

In scope

Credit institutions

Banks, building societies, credit unions, and other entities with a banking licence. All ICT third-party arrangements are subject to DORA Article 28 requirements regardless of size.

In scope

Payment and e-money institutions

Payment institutions and electronic money institutions authorised under PSD2. This covers most fintech startups processing payments or issuing e-money in the EU/EEA. DORA applies even if you are a small startup.

In scope

Investment firms and crypto asset providers

MiFID II-authorised investment firms and CASP-licensed crypto asset service providers under MiCA. Includes exchanges, custody providers, and crypto payment processors.

Also in scope

Insurance and reinsurance undertakings

Solvency II-regulated insurers and reinsurers operating in the EU. Insurance technology (insurtech) firms holding authorisation are fully in scope for DORA ICT risk requirements.

Indirect scope

ICT service providers to regulated firms

If you provide ICT services to any of the above, your customers’ DORA obligations flow down to you. Enterprise customers will ask you to complete DORA due diligence questionnaires and demonstrate compliance with Article 28 contractual requirements.

DORA Article 28

What DORA Article 28 actually requires from you

Article 28 is the heart of DORA’s third-party risk framework. Here is each requirement translated into what you need to do — and what evidence you need to show.

Art. 28.2

Maintain an ICT third-party register

Keep a complete, up-to-date register of all ICT third-party service providers your organisation uses. The register must clearly distinguish between providers supporting critical or important functions (higher scrutiny) and those that do not. You must be able to produce the register to your regulator on request.

VendorAuditly: live register with risk classification, exportable in one click
Art. 28.3

Pre-contract due diligence proportionate to criticality

Before entering any ICT outsourcing arrangement, conduct and document due diligence appropriate to the risk. For critical/important functions, this means a formal security assessment. For non-critical functions, lighter-touch due diligence is acceptable. The key is documentation — verbal assurances are not evidence.

VendorAuditly: DORA due diligence questionnaire template, dated response storage
Art. 28.4

Mandatory contractual provisions

Contracts with ICT providers must include: full service description, data location and processing details, audit rights, conditions for sub-outsourcing, exit rights, and incident notification timelines. Document which contracts include which provisions — not just that you have contracts.

Art. 28.5

Risk-proportionate ongoing assessments

After onboarding, reassess ICT providers periodically based on their risk classification. Critical/important function providers require annual re-assessment with documented evidence. Non-critical providers can be assessed less frequently. The cadence must be defined and demonstrably followed.

VendorAuditly: assessment scheduling by risk tier, dated completion records
Art. 28.7

Exit and substitution strategies

For critical ICT providers, document how you would exit the relationship and transition to an alternative provider. The exit strategy must be realistic — identify alternative providers, estimate transition timelines, and consider data portability requirements.

Regulator expectations

What a DORA inspection looks for

National Competent Authorities (NCAs) and the Joint Examination Teams (JETs) for Critical ICT Providers will look for specific evidence during DORA supervisory activities. Here is what they expect to see.

❌
What fails inspection
Common gaps found in early DORA reviews
ICT registerSpreadsheet, incomplete
Risk classificationNot documented
Due diligenceEmail threads, no dates
AssessmentsNo cadence, no dates
Exit strategiesNot documented
✓
What passes inspection
VendorAuditly evidence output
ICT registerComplete, risk-classified, live
Risk classificationCritical vs non-critical documented
Due diligenceDated questionnaire records
AssessmentsScheduled, completed, dated
Exit strategiesDocumented per critical provider
Implementation

Build DORA compliance in days, not months

No GRC consultant. No six-month implementation. No six-figure budget. VendorAuditly gets a financial institution DORA-ready in a single week.

1

Build your ICT third-party register

Import your vendor list and classify each provider: critical/important function or non-critical. Add data location, service type, and contract owner. This satisfies DORA Article 28.2 and forms the foundation of all other obligations.

2

Send DORA due diligence questionnaires

Use VendorAuditly’s DORA-aligned template to assess ICT security, resilience, data location, sub-outsourcing, and incident notification processes. Responses are dated and stored — direct evidence for Article 28.3 pre-contract due diligence.

3

Track compliance certificates with expiry alerts

Upload SOC2, ISO 27001, and cyber liability certificates for critical providers. VendorAuditly alerts you before they expire so your evidence file stays current without manual monitoring.

4

Schedule annual assessments for critical providers

VendorAuditly prompts re-assessment of critical ICT providers annually. Completion dates are recorded automatically — demonstrating the systematic approach DORA Article 28.5 requires.

5

Export your DORA evidence pack

When an NCA inspection comes, click export. The evidence pack includes your ICT register, risk classifications, due diligence records with dates, certificates on file, assessment history, and audit trail — everything Article 28 requires, in one file.

Common questions

Frequently asked questions

What does DORA require for vendor management?
DORA Article 28 requires: a complete ICT third-party register with risk classifications, pre-contract due diligence proportionate to criticality, mandatory contractual provisions (audit rights, exit rights, data location, incident notification), ongoing risk-based assessments with documented evidence, and exit/substitution strategies for critical providers. The key shift from previous practice: everything must be documented with dates, not just done informally.
Who does DORA apply to for vendor management?
DORA applies to credit institutions, payment institutions, e-money institutions, investment firms, insurance undertakings, and crypto asset service providers operating in the EU/EEA. This covers most licensed fintechs, challenger banks, neobanks, PSPs, and insurtech firms. Size does not exempt smaller entities — though the principle of proportionality means smaller, simpler firms can use lighter-touch approaches.
What is an ICT third-party register under DORA?
An ICT third-party register is a complete inventory of all ICT service providers your organisation uses, with each provider classified as supporting critical/important functions or non-critical functions. It must include provider name, services provided, data location, and contract dates. VendorAuditly maintains this as a live register that updates as assessments complete and certificates arrive.
How often must DORA vendor assessments be conducted?
Critical/important function providers: annual assessment at minimum, plus continuous monitoring for breach events and certificate expiry. Non-critical providers: less frequent, but still documented. The key DORA requirement is that the cadence is defined, applied consistently, and evidenced — not just performed when someone has time.
How does VendorAuditly help with DORA vendor management?
VendorAuditly provides: a live ICT third-party register with critical/non-critical classification, DORA-aligned questionnaire templates with dated response storage, certificate tracking with expiry alerts, scheduled re-assessment prompts, and a one-click DORA evidence pack export — all at $49/month, with same-day setup and no implementation required.

Related guides

DORA Article 28 ready

Build your DORA ICT register at $49/month

ICT third-party register, DORA due diligence questionnaires, certificate tracking, and one-click evidence export. DORA-ready in days, not months.

Start free →

No credit card required. Set up in under an hour.