Article 29Preliminary assessment of ICT concentration risk at entity level
What it says
1. When performing the identification and assessment of risks referred to in Article 28(4), point (c), financial entities shall also take into account whether the envisaged conclusion of a contractual arrangement in relation to ICT services supporting critical or important functions would lead to any of the following:
(a) contracting an ICT third-party service provider that is not easily substitutable; or
(b) having in place multiple contractual arrangements in relation to the provision of ICT services supporting critical or important functions with the same ICT third-party service provider or with closely connected ICT third-party service providers.
Financial entities shall weigh the benefits and costs of alternative solutions, such as the use of different ICT third-party service providers, taking into account if and how envisaged solutions match the business needs and objectives set out in their digital resilience strategy.
DORA, the European Union regulation on digital operational resilience, Article 29Show the rest of the text(4 more paragraphs, about 240 words)
2. Where the contractual arrangements on the use of ICT services supporting critical or important functions include the possibility that an ICT third-party service provider further subcontracts ICT services supporting a critical or important function to other ICT third-party service providers, financial entities shall weigh benefits and risks that may arise in connection with such subcontracting, in particular in the case of an ICT subcontractor established in a third-country.
Where contractual arrangements concern ICT services supporting critical or important functions, financial entities shall duly consider the insolvency law provisions that would apply in the event of the ICT third-party service provider’s bankruptcy as well as any constraint that may arise in respect to the urgent recovery of the financial entity’s data.
Where contractual arrangements on the use of ICT services supporting critical or important functions are concluded with an ICT third-party service provider established in a third country, financial entities shall, in addition to the considerations referred to in the second subparagraph, also consider the compliance with Union data protection rules and the effective enforcement of the law in that third country.
Where the contractual arrangements on the use of ICT services supporting critical or important functions provide for subcontracting, financial entities shall assess whether and how potentially long or complex chains of subcontracting may impact their ability to fully monitor the contracted functions and the ability of the competent authority to effectively supervise the financial entity in that respect.
What it means in practice
Concentration risk, assessed before signing rather than discovered afterwards. When identifying and assessing risks under Article 28(4)(c), for arrangements covering ICT services that support critical or important functions, entities must consider whether the arrangement would mean contracting a provider that is not easily substitutable, or holding multiple such arrangements with the same provider or closely connected providers. They must weigh the benefits and costs of alternatives, such as different providers, against their business needs and digital resilience strategy.
Where the contract allows the provider to subcontract a service supporting a critical or important function, the entity must weigh the benefits and risks, particularly where a subcontractor is established in a third country. For any arrangement supporting a critical or important function it must also consider the insolvency law that would apply if the provider failed, and any constraint on urgent recovery of its data. Where the provider itself is in a third country, it must also consider compliance with Union data protection rules and the effective enforcement of law there.
The entity must also assess whether long or complex subcontracting chains could limit its ability to monitor the contracted functions, or the authority’s ability to supervise it.
Article 28(4)(c) names concentration risk as a risk to assess; this article says what to look at. It asks the entity to weigh these matters and sets no limit on acceptable concentration. The subcontracting detail is in Commission Delegated Regulation (EU) 2025/532, made under Article 30(5); check the current text for amendments.
What is in the packs for this
Each one helps with this requirement.
- Excel
DORA Article-to-Control Mapping Library
in DORA ICT Risk & Resilience ReadinessRequirement Library rows RQ-46, RQ-50: Assess before you contract, then audit; Subcontracting of critical or important services. Each gives the provision in plain words, what to show and the documents that help. - Excel
DORA Readiness Self-Assessment
in DORA ICT Risk & Resilience ReadinessReadiness items TP-03, TP-05: Assessment before contracting, audit and concentration; Exit plans and subcontracting for critical or important arrangements. Each rates how ready the entity is, with the evidence and the gap. - Excel
ICT Third-Party Arrangements Register — Working Copy
in DORA ICT Risk & Resilience ReadinessThe Arrangements sheet shows substitutability and several arrangements with one provider; the Supply chain and Providers sheets show subcontractors and their rank. - Excel
DORA Documentation & Evidence Checklist
in DORA ICT Risk & Resilience ReadinessEvidence records EV-28, EV-32: Pre-contract assessments, due diligence and concentration checks for critical or important arrangements; Subcontracting assessments and the record of notified changes. Each lists the records a supervisor can ask for. - Word
Supplier Criticality & Tiering Model
in Third-Party Security Risk ManagementConcentration looks across suppliers for providers that several critical services depend on, using the substitutability criterion TC-4. - Excel
Supplier Security Risk Register
in Third-Party Security Risk ManagementCounts critical services per provider (TPM-04) with substitutability (TC-4) and exit plan, to show concentration. - Excel
Third-Party Risk Dashboard
in Third-Party Security Risk ManagementThe Concentration view lists providers that several critical services depend on, with their exit plans.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.