How do we leave an ICT provider that supports a critical or important function without stopping the service?

Start

A provider behind a critical or important function must go

DORA asks the entity to be able to exit a service that supports a critical or important function without disrupting its business, without limiting its regulatory compliance and without harming the continuity and quality of service to clients (Article 28(8)). Three things make that possible: a documented exit plan, a contractual transition period and an alternative that is ready. Work through them before you end anything, whether you chose to leave or events forced it.

• Then: Does the service support a critical or important function?

Decision

Does the service support a critical or important function?

These duties are for services that support critical or important functions, which the entity decides and records with reasons. A function not yet assessed is treated as critical or important until it is (DR-10), which is the pack's working rule and not a rule of DORA. Take the first branch if you are unsure. If the function is assessed as neither, an ordinary supplier exit is enough.

• Yes, not yet assessed, or not known: Are we leaving by choice, with time to plan?
• No, assessed as neither: Use an ordinary supplier exit

Outcome

Use an ordinary supplier exit

Move the service, remove every account and connection the supplier had, have the supplier return or delete your data and then its backup copies, get written confirmation of deletion, and keep the supplier's record with the exit date. The supplier flow covers these steps.

Decision

Are we leaving by choice, with time to plan?

A planned exit lets you use the transition period and your plan in order. A forced exit starts from the contract's termination rights, so check them first. DORA asks the entity to be able to end an arrangement for a significant breach, for circumstances found in monitoring that could alter the function's performance, for evidenced weaknesses in the provider's ICT risk management, and where the authority can no longer supervise the entity.

• Yes, planned: Tell the management body and the function owner
• No, or not known: forced: Check the contract lets us end it for that reason

Step

Check the contract lets us end it for that reason

Read the termination rights and the notice periods (the register holds the notice periods, B_02.02.0100 and B_02.02.0110). Judgement: if the contract does not let you end it for the reason you have, take it to Legal before you act, because a wrongful termination is a risk in itself. If the cause is an incident, incident response and its decision rights and clocks stay with your incident procedure, and are not restated here.

• Then: Tell the management body and the function owner

Step

Tell the management body and the function owner

Judgement: tell the management body early, because a provider change for a critical or important function is the kind of change it keeps channels to hear about. DORA's reporting channels cover ICT third-party arrangements, planned material changes to providers and the effect of those changes on critical or important functions (RQ-05, entities under the full framework). Exit is also a step in the life cycle that the third-party policy covers (RQ-44). Confirm the function's recovery objectives with its owner, because the replacement has to meet them.

• Then: Is there a documented exit plan, reviewed and tested in 12 months?

Decision

Is there a documented exit plan, reviewed and tested in 12 months?

DORA asks for a comprehensive, documented exit plan for each such arrangement, tested and reviewed periodically. The pack's default is 12 months (DR-17), and the period is the entity's own to set. If you do not know, take the second branch.

• Yes: Does the contract give a transition period while it keeps serving?
• No, or not known: Write or refresh the plan before you act

Step

Write or refresh the plan before you act

The plan has alternative solutions, transition plans and contingency measures. It rests on plausible scenarios: an unforeseen and persistent service interruption, inappropriate or failed service delivery, and unexpected termination. It is realistic, and its schedule fits the contract's termination terms. The pack says how often to review and test a plan, not how to test it (judgement: walk it through with the people who would run it).

• Then: Does the contract give a transition period while it keeps serving?

Decision

Does the contract give a transition period while it keeps serving?

The contract for a critical or important function should include an exit strategy with a mandatory, adequate transition period in which the provider continues the service and lets you move to another provider or in house (FD-07). That period is the time you have. If you cannot tell, take the second branch.

• Yes: Is there a named alternative provider or in-house route?
• No, or not known: Ask the provider for the transition term now

Step

Ask the provider for the transition term now

An older contract does not wait for its renewal to be brought into line (DR-11). The library's exit clause is a model: it keeps the service running while it moves to another provider or back in house. Legal holds the contract and makes the request.

• Then: Will the provider agree to a transition period?

Decision

Will the provider agree to a transition period?

If the provider agrees, record the amendment against the contract (EV-30). If it refuses, you have a contract for a critical or important function that lacks a term it should have, and that changes what you can safely do.

• Yes: Is there a named alternative provider or in-house route?
• No: Escalate: the contract lacks a term it needs

Outcome

Escalate: the contract lacks a term it needs

A missing Article 30(3) term is a gap in a binding duty and may be a blocking gap, which goes to the management body at its next meeting (DR-05). Enter it in your gap list. Whether to keep the provider while you negotiate, or to look for a replacement under pressure, is for the management body with counsel.

Decision

Is there a named alternative provider or in-house route?

The register's assessment records how easily the provider can be substituted, how hard reintegration would be, the impact of discontinuing and whether alternatives are identified (RV-09). Judgement: an alternative that exists only in the plan, with no one who has checked it, is not named. If you do not know, take the second branch.

• Yes: Contract the replacement to the same standard
• No, or not known: Assess the options: another provider or taking it in house

Step

Assess the options: another provider or taking it in house

Compare the options on what the register assessment already records: substitutability, difficulty of reintegration and the impact of discontinuing. Weighing them is a judgement for the function owner and the management body, and the pack does not say how. Include the cost and the time each route needs.

• Then: Can a route be ready inside the transition period?

Decision

Can a route be ready inside the transition period?

The transition period is the time you have. If the alternative cannot take the function before it ends, leaving on this timetable would stop the service. If you do not know, take the second branch.

• Yes: Contract the replacement to the same standard
• No, or not known: Do not end it yet: take the options to the management body

Outcome

Do not end it yet: take the options to the management body

Judgement, not a pack rule: for a planned exit, keep the arrangement or extend the transition while the alternative is built, because ending it with no route would stop the service. Where the exit is forced, the exit plan's contingency measures and your recovery plans apply. The management body decides, and the dependency belongs in your risk and concentration review.

Step

Contract the replacement to the same standard

The replacement is a new arrangement for a critical or important function. It needs the register assessment, the Article 30(3) terms, its own exit plan, a subcontracting assessment and a concentration check, and your authority must be told before the arrangement is signed (DR-11). Keep the record of what you told it and when (EV-33).

• Then: Move the function in stages with the old provider still serving

Step

Move the function in stages with the old provider still serving

Judgement: the transition term exists so the old provider keeps the service running while the new route takes over, so switch it off last. The contract's data return term (FD-02) applies when the arrangement ends, so agree how and when your data comes back in an accessible format, and restore it into the new service before you rely on it. The backup standard holds the restore tests.

• Then: Does the new route run the function within its recovery objectives?

Decision

Does the new route run the function within its recovery objectives?

The function's recovery objectives are in the register in hours (RV-06). The recovery pack owns objectives and the recovery test (RR-14). Check the new route against them with the function owner, not against the provider's say-so. If you cannot show it, take the second branch and stay on the old provider.

• Yes: Take back data, remove access and update the register
• No, or not known: Stay on the old provider and take the gap to the management body

Outcome

Stay on the old provider and take the gap to the management body

Judgement: do not switch the old provider off while the new route cannot show the recovery objectives. Keep serving on the old provider within the transition period, fix the route with the function owner, and run the check again. If the transition period would end first, the management body decides whether to extend it or accept the risk. Your recovery plans apply meanwhile.

Step

Take back data, remove access and update the register

Complete the data return and the deletion with the old provider, and remove every account and connection it had. In the register, give the old arrangement its end date and the reason for ending it, and add the replacement. Update the exit plan for the new provider, and keep the exit and test records as evidence (EV-31).

• Then: The function runs on the new route and the old one is closed

Outcome

The function runs on the new route and the old one is closed

The service did not stop, the register shows the change, and your plan, contract and test records are on file for your authority to see. Review the new exit plan at the period your standard sets.