Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

When do we…

When is a supplier supporting a "critical or important function" under DORA?

5 decision pointsThe pack behind this answer: Third-Party Security Risk Management

Add to board memo

The short answer

Recommendation
If you are a DORA financial entity, an ICT service supports a critical or important function when that function's disruption would materially impair you and the service runs or supports it. Where either answer is not yet known, treat it as yes: the supplier is Tier 1 and its contract takes the extra DORA content.
Reasoning
The answer changes how much assurance the supplier needs and what its contract must contain. It is a question about your function and the supplier's part in it, so the supplier's size or quality does not settle it. The pack's working definition is a function whose disruption would materially impair the entity's performance, soundness or continuity of services, or its compliance. A yes on any one part is enough. Recording the judgement against the function, beyond the supplier file, gives every supplier of that function the same answer and shows where critical functions depend on one provider.
Considerations
  • The judgement is yours. The business owner supplies the facts and Legal or Compliance applies the test. If your DORA status is unclear, treat it as yes until they confirm it.
  • The pack summarises DORA's contract content. Have your legal adviser check each contract against the full text of Article 30.
  • A non-ICT supplier takes no DORA floor or ICT contract content. When a financial entity tiers it, 'critical service' still has DORA's meaning, so it can reach Tier 1 on service alone.
  • A service that does not support a critical or important function still takes DORA's contract content for all ICT services.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA supplier may support a critical or important functionDecisionIs your organisation a financial entity under DORA?OutcomeDORA's test does not apply; tier on your critical servicesDecisionIs the supplier providing an ICT service?OutcomeTier it on the criteria, reading 'critical' in DORA's senseStepName the business function the service runs or supportsDecisionIs that function already on your list of critical or important ones?StepApply the definition with Legal or ComplianceDecisionWould its disruption materially impair the entity?StepAdd the function to your list, with the reasonsOutcomeNot supporting a critical or important function: record whyDecisionWould the function stop or degrade if the service failed?OutcomeTreat it as supporting a critical or important function

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 13 steps.

  1. Start

    A supplier may support a critical or important function

    The answer changes how much assurance the supplier needs and what its contract must contain. It is a question about your function and the supplier's part in it, not about the supplier's size or quality. Ask it at intake, before the contract, and again whenever your functions or your regulatory status change.

    In the pack

  2. Decision

    Is your organisation a financial entity under DORA?

    DORA applies to financial entities. If you are not one, the term has no legal meaning for you and your own list of critical services does the same job. If your status is unclear, answer yes until Legal or Compliance confirms it.

    In the pack

  3. Outcome

    DORA's test does not apply; tier on your critical services

    Tier the supplier on the four usual criteria, using your own list of critical services for the service question. Look again if your regulatory status changes: the pack lists that as a trigger for tiering suppliers again.

    In the pack

    See also

  4. Decision

    Is the supplier providing an ICT service?

    The DORA floor in the pack's tiering applies to an ICT service supporting a critical or important function, and DORA's contract content applies to contracts for ICT services. The pack does not define ICT service; ask Legal or Compliance where it is unclear, and answer yes until they have.

    In the pack

  5. Outcome

    Tier it on the criteria, reading 'critical' in DORA's sense

    No DORA floor or ICT contract content applies. But for a financial entity, the service question in tiering still reads 'critical service' in DORA's sense: a non-ICT supplier that runs or supports a critical or important function still reaches Tier 1 on that question alone.

    In the pack

  6. Step

    Name the business function the service runs or supports

    Name the function, not the system: payments, claims handling, customer onboarding. A supplier can support more than one. Include indirect support, such as the provider hosting the system the function runs on.

    In the pack

  7. Decision

    Is that function already on your list of critical or important ones?

    Your business continuity plan or service inventory should hold the list. If the function is on it, the judgement has been made and recorded; use it. If there is no list, or the function is missing, the test has to be applied now.

    In the pack

  8. Step

    Apply the definition with Legal or Compliance

    The pack's working definition: a function whose disruption would materially impair the financial entity's performance, soundness or continuity of services, or its compliance. The judgement is yours; the business owner supplies the facts and Legal or Compliance applies the test.

    In the pack

  9. Decision

    Would its disruption materially impair the entity?

    Consider each part in turn: performance, soundness, continuity of services, and compliance. A yes to any one is enough. If the answer is disputed or not yet known, treat it as yes until it is settled.

    In the pack

  10. Step

    Add the function to your list, with the reasons

    Record the decision where the rest of the organisation will find it, not only in the supplier file. Every supplier supporting the function then gets the same answer, and the concentration of critical functions on one provider becomes visible.

    In the pack

  11. Outcome

    Not supporting a critical or important function: record why

    Either the function is not critical or important, or this service does not really support it. Record the reasoning and who made the call. The supplier is tiered on the usual criteria, and DORA's contract content for all ICT services still applies to it. Re-test if the function grows or your list is revised.

    In the pack

  12. Decision

    Would the function stop or degrade if the service failed?

    This is the support test from intake: which of your services does it run or support, and what would stop or degrade if it failed. If the service is only incidental, answer no and record why. If you don't know, answer yes.

    In the pack

  13. Outcome

    Treat it as supporting a critical or important function

    In the pack, the supplier becomes Tier 1 whatever its other answers, with the deepest assurance. Its contract takes the DORA Article 30(2) content for all ICT services and the additional Article 30(3) content: full service levels, notice duties, contingency plans and security, testing participation, audit and access rights, exit strategies. Record the arrangement in your register of information (Article 28(3)).

    In the pack

    See also

Practical checklist

  1. Confirm with Legal or Compliance whether your organisation is a financial entity under DORA.
  2. Check whether the supplier provides an ICT service, and treat it as one until Legal or Compliance says otherwise.
  3. Name the business function the service runs or supports, including indirect support such as hosting.
  4. Look for the function on your list of critical or important functions in your business continuity plan or service inventory.
  5. If it is not listed, apply the definition with Legal or Compliance, and add the function to your list with the reasons.
  6. Ask whether the function would stop or degrade if the service failed. Answer yes if you do not know.
  7. If both answers are yes, set the supplier at Tier 1 and add the DORA contract content for critical or important functions.
  8. Record the arrangement in your register of information, and test again when the function or your list changes.

Evidence to have ready

  • Your list of critical or important functions, with the reasons for each decision and who made it.
  • For each supplier, the function it supports and the support test answer, or the recorded reasoning where it does not support one.
  • The tier record showing the DORA floor applied where it does (TP-02).
  • The contract checked against the DORA content, and its entry in your register of information.

Assumptions

  • Your organisation is, or may be, a financial entity under DORA. If it is not, this test does not apply.
  • The tier and contract consequences shown are the defaults in the CISO Times third-party pack. The pack summarises DORA's contract content; your legal adviser checks contracts against the full text.

Not covered here