How do we build and keep our register of information on ICT third-party arrangements?

Start

We must build or repair our register of ICT arrangements

The register lists every contractual arrangement for ICT services, in the templates of the implementing regulation, and marks the ones that support critical or important functions. The pack puts it first among the third-party tasks, because every judgement about a provider starts from the list. Follow the same steps whether you are building it for the first time or repairing a contract list that was never checked.

• Then: Do we know DORA binds us as a financial entity?

Decision

Do we know DORA binds us as a financial entity?

DORA binds financial entities only. ICT third-party service providers are not financial entities, so a supplier does not keep this register. Its customer does. Settle which you are with the scope assessment before you spend time on the register, and take the third branch if you cannot say.

• Yes: Get your authority's dates, channel and file format
• No: we supply a financial entity: This register is your customer's: use the supplier path
• No, or not known: Decide what you are first, then return here

Outcome

This register is your customer's: use the supplier path

Your customer keeps the register and needs information from you for it: your legal name, a valid LEI or EUID, your ultimate parent, your headquarters country, and the same identifiers for any subcontractors behind a critical or important service (FD-09). The contract side of the request is in the supplier flow.

Outcome

Decide what you are first, then return here

Complete the scope assessment before anything else (DR-01). It gives your entity type, any exclusion, whether the simplified framework applies and whether you are a microenterprise. The management body approves it and counsel confirms it. Come back when it shows that DORA binds you. Where your competent authority tells you something different, its view stands.

Step

Get your authority's dates, channel and file format

The duty is the entity's, but the pack states no dates, channels or file format, because your authority sets them (DR-21). Ask for them now. They decide the format you copy the content into. The working copy follows the columns of the implementing regulation so that the copy needs no rearranging, but it is not the submission format.

• Then: List your functions and decide which are critical or important

Step

List your functions and decide which are critical or important

Every arrangement points to a function, so list the functions first. The function owner proposes whether each is critical or important, the DORA programme lead records the reason, and the management body approves the list (DR-09). Each function needs a criticality answer, a date and recovery objectives in hours (RV-06). The decision is your judgement under DORA's definition, and counsel can check it.

• Then: Is every function assessed, with the reason recorded?

Decision

Is every function assessed, with the reason recorded?

A function left at 'Assessment not performed' gives a duty finding (RV-11). If any function is unassessed, or you cannot tell, take the second branch.

• Yes: List every arrangement and ask each provider for its LEI or EUID
• No, or not known: Treat unassessed functions as critical or important for now

Step

Treat unassessed functions as critical or important for now

The pack's working rule is that a function not yet assessed is treated as critical or important until it is, and every arrangement behind it is handled as one that supports a critical or important function (DR-10). This is the pack's rule, not a rule of DORA, so your own policy may differ. It stops providers being handled as ordinary because nobody has decided yet.

• Then: List every arrangement and ask each provider for its LEI or EUID

Step

List every arrangement and ask each provider for its LEI or EUID

List every arrangement before you judge any of them, including intra-group ones and small or free services (DR-08). A register built from the contract list alone misses some. Ask each provider and each subcontractor for a valid LEI or EUID now, because they take weeks to answer (FD-09). An individual acting in a business capacity is identified by a country code with CRN, VAT, PNR or NIN (RV-03).

• Then: Enter each arrangement and the chain of providers behind it

Step

Enter each arrangement and the chain of providers behind it

Give each arrangement one reference number that stays with it for life (RV-01), its type, a service type from S01 to S19 (RV-04), its dates and the function it supports. In the supply chain the direct provider is rank 1 and each subcontractor has a higher rank and names the provider it serves (RV-08). Include every subcontractor that effectively underpins a service supporting a critical or important function.

• Then: Does this arrangement support a critical or important function?

Decision

Does this arrangement support a critical or important function?

Arrangements behind a critical or important function need more: notice periods, the countries of governing law and of service, where the data sits, its sensitiveness and your reliance (RV-07), and a full assessment of substitutability, last audit, exit plan, reintegration, impact of discontinuing and alternatives (RV-09). Take the first branch also when the function is not yet assessed (DR-10).

• Yes, or not yet assessed: Complete the extra columns and the full assessment
• No: Run the register checks RV-01 to RV-12

Step

Complete the extra columns and the full assessment

Fill the conditional columns and the assessment on the same row as the arrangement. The assessment shows whether an exit plan exists (RV-12). The pack also lists what such an arrangement needs: the Article 30(3) contract terms, a subcontracting assessment, a concentration check and telling your authority before signing (DR-11). An older contract does not wait for its renewal.

• Then: Run the register checks RV-01 to RV-12

Step

Run the register checks RV-01 to RV-12

RV-01 to RV-10 are data checks: the register breaks the implementing regulation's own rules. RV-11 and RV-12 are duty checks: the register is valid and shows a duty that is not met. Report counts with the gaps named, such as '1 of 7 arrangements supports a critical or important function', and never a score or a share (DR-04).

• Then: Is any data finding (RV-01 to RV-10) still open?

Decision

Is any data finding (RV-01 to RV-10) still open?

The register shows no open data finding before it is submitted (DR-08). A data finding is a defect in the register itself, such as a missing code, a date typed as text or a subcontractor with no recipient. Fix these before you look at the duty findings.

• Yes, or not known: Correct the rows and run the checks again
• No: Do the checks show a duty finding (RV-11 or RV-12)?

Step

Correct the rows and run the checks again

Fix the row each finding names, then rerun. Ask the provider for any missing identifier, and do not enter a code you have invented: a valid LEI carries check digits, and the check reads them (RV-03). Repeat until no data finding is left.

• Then: Run the register checks RV-01 to RV-12 (back to an earlier step)

Decision

Do the checks show a duty finding (RV-11 or RV-12)?

A duty finding is not an error in the data. RV-11 means a function is not yet assessed. RV-12 means an arrangement behind a critical or important function has no exit plan. Both show a gap in your readiness, so they go on your gap list rather than being corrected in the register.

• Yes: Enter each duty finding in your gap list with an owner and a date
• No: Submit in your authority's format and report the counts

Step

Enter each duty finding in your gap list with an owner and a date

Give every gap an owner, an effort and a due date (DR-06). The pack's defaults are 30, 90 and 180 days for Priority 1, 2 and 3, and your own standard may set different ones, kept at least as strict. A missing exit plan may leave a binding readiness item below In place. That is a blocking gap, which goes to the management body at its next meeting (DR-05).

• Then: Submit in your authority's format and report the counts

Step

Submit in your authority's format and report the counts

Copy the content into the format your authority sets and submit it by the date it gives. The entity also reports at least yearly on new arrangements, the categories of providers, the types of arrangement and the services and functions provided, and makes the full register available on request (RQ-43). Keep the acknowledgement as evidence (EV-25). Report the counts with the gaps named to whoever your procedure names (DR-04).

• Then: Review the register on a schedule and on every change

Step

Review the register on a schedule and on every change

Review the whole register on a schedule you set (the working copy's placeholder is each quarter), and whenever a contract is signed, changed or ended or a function is reassessed. Review the critical or important function list and its reasons at least every 12 months, the pack's default (DR-09). An arrangement that has ended stays in the register with its end date and a reason (RV-05).

• Then: Is a new critical or important arrangement planned?

Decision

Is a new critical or important arrangement planned?

The entity tells its authority in good time about any planned arrangement for a critical or important function, and when a function becomes critical or important (RQ-43). The pack's own rule is to do this before the arrangement is signed (DR-11). Take the first branch also when you are not sure whether the function is critical or important.

• Yes, or not sure: Tell your authority before you sign
• No: A valid register, kept current and reported

Step

Tell your authority before you sign

Use the channel and form your authority sets (DR-21). Keep a record of what you told it and when, because the evidence list asks for the date (EV-33). The new arrangement then goes into the register with its full assessment like any other.

• Then: A valid register, kept current and reported

Outcome

A valid register, kept current and reported

You have every arrangement listed, no open data finding, each duty finding on your gap list and a submission in your authority's format. Keep the records for the period your standard sets (the pack's default is in DR-19). The register is a file you keep, with a review date and an owner.