ICT Third-Party Arrangements Register — Working Copy
Internal working register of ICT service arrangements; submission format follows the official implementing standard.
Available soon
- Format
- Excel
- Size
- 150 KB
- Length
- 12 sheets
- Version
- 1.2
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.2
The mappings note no longer says the CISO Times Library shows a verification state; it says what a mapping shows and to confirm it against both texts.
- 1.1
A financial entity that sells ICT services is also a supplier, and any Priority 1 gap goes to the chair route.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | What this workbook is. Working copy only: the official submission format follows Implementing Regulation (EU) 2024/2956. Your competent authority sets the dates, the channel and the file format of the submission (DR-21). Use this workbook to build and check the content, then copy it into that format. Use it only where your scope assessment (DORA Proportionality & Scope Assessment) shows that DORA binds you (DR-01). |
| 2 | Start on the Checks sheet. Set the as-at date and enter the details of the entity that keeps the register (template B_01.01). The as-at date is the date the register is checked at. Type it, never a formula. |
| 3 | Enter the functions on the Functions sheet (template B_06.01) before anything else, because every arrangement points to one (DR-08). The function owner proposes whether each is critical or important, the DORA programme lead records the reason, and the management body approves the list (DR-09). A function left at "Assessment not performed" is treated as critical or important until it is assessed (DR-10). |
| 4 | Enter every direct provider and every subcontractor on the Providers sheet (template B_05.01), each with a valid LEI or an EUID. Collect the codes early: providers take weeks to answer (FD-09). List arrangements with small or free services and intra-group arrangements too (DR-08). |
| 5 | Enter one row for each arrangement on the Arrangements sheet (templates B_02.01 and B_02.02, which share the reference number). Yellow cells are inputs. The conditional columns (notice periods, countries, data, reliance) are required when the arrangement supports a critical or important function or its function is not yet assessed. Enter dates as dates: a date typed as text is flagged. |
| 6 | Enter the chain behind each arrangement on the Supply chain sheet (template B_05.02). The direct provider is rank 1 on every arrangement. A subcontractor has a higher rank and the row names the provider that receives its service. Include every subcontractor that effectively underpins a service supporting a critical or important function. |
| 7 | Enter one assessment for each arrangement that supports, or is treated as supporting, a critical or important function in the last columns of the Arrangements sheet (template B_07.01), on the same row as the arrangement. |
| 8 | Read the calculated columns at the right of each sheet. "Result" names the checks that fail on the row. The Arrangements sheet also shows how its function is assessed, whether the arrangement is treated as critical or important, and what it needs: the register assessment, the Article 30(3) contract terms, an exit plan, a subcontracting assessment, a concentration check and telling the competent authority before signing (DR-11). |
| 9 | Read the Checks sheet for the findings and the counts. Data findings (RV-01 to RV-10) mean the register breaks the Implementing Regulation's own rules: the register shows none before it is submitted (DR-08). Duty findings (RV-11 and RV-12) mean the register is valid and shows a duty that is not met: enter each in the DORA Gap & Remediation Tracker with an owner and a due date (DR-06). |
| 10 | Report counts with the gaps named, such as "1 of 7 arrangements supports a critical or important function", and no score or share (DR-04). The DORA Readiness Self-Assessment reads the register's counts for its readiness item on the register of information. |
| 11 | Keep the register up to date. Review the whole register at least [[each quarter]], and whenever a contract is signed, changed or ended, or a function is reassessed. Review the list of critical or important functions and their reasons at least every [[12]] months (DR-09). |
| 12 | To clear the EXAMPLE, delete the EXAMPLE rows on every sheet once your own are entered. The formulas stay. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Limitations: This document helps you see what DORA asks of an entity like yours and what you can show. It is not legal advice, and following it is not a statement that you comply with DORA or any standard. Whether DORA binds you, and which of its duties apply to you, depends on what you are, how you are authorised and how your Member State and your supervisor apply it: confirm it with counsel or your competent authority.
Official format: Working copy only: the official submission format follows Implementing Regulation (EU) 2024/2956. This workbook holds templates B_01.01, B_02.01, B_02.02, B_05.01, B_05.02, B_06.01 and B_07.01. Templates B_01.02, B_01.03, B_02.03, B_03.01, B_03.02, B_03.03, B_04.01 and B_99.01 are not held here. Complete them in the submission format (see the Definitions sheet).
Who this is for. DORA is one regulation with five pillars: ICT risk management, ICT-related incident management and reporting, digital operational resilience testing, the management of ICT third-party risk, and information sharing. Every financial entity meets the same five pillars, and the depth of each depends on what the entity is. A microenterprise, a small investment firm, an exempted payment institution and a large bank each owe a different part of each pillar, and the Regulation says which. So the first question is what you are, the second is which duties that makes yours, and only then is it worth asking how ready you are. Being ready is a count of duties in place and duties still open. It is never one score.
Mappings. This library does not say which ISO/IEC 27001 controls or NIST CSF outcomes meet a DORA requirement. It gives each article's own words, what an entity must be able to show, and the CISO Times documents that help with the work. Where the CISO Times Library holds a mapping between a DORA requirement and a control, it shows it there with how closely the two match and where they differ; confirm it against both texts before relying on it. A document listed here helps with the work a requirement describes. Using it does not by itself show that the requirement is met.
A group keeps the register at sub-consolidated and consolidated level as well (DR-23). This working copy covers one entity. Take advice for the rest.
If you supply ICT services to a financial entity: this register is your customer's, not yours (DR-22). DORA lists ICT third-party service providers in Article 2(1), point (u), and defines financial entities as points (a) to (t) only. Its duties for the contract fall on the financial entity. A supplier is reached by DORA mainly through the terms its customers must ask for (the supplier flow-down list) and the information they must collect. A supplier designated as critical is also overseen by a Lead Overseer. Your customer needs from you what the register holds about you (The information the entity must enter in its register: the provider's legal name, a valid LEI or EUID, its ultimate parent, the country of its headquarters, and the same identifiers for the subcontractors behind a critical or important service), and the contract terms of FD-01, FD-05, FD-06, FD-07, FD-08.
EXAMPLE: Lantern Pay Services (EXAMPLE), a small authorised payment institution in an EU Member State, with 64 staff, as at 30 Sep 2026. Its register holds 7 arrangements and 1 subcontractor row. 1 of 7 arrangements support a critical or important function. The checks find 1 data finding and 1 duty finding.
Adapting this template:
• Replace the [[placeholders]] with your own values, and delete the EXAMPLE rows on every sheet once you have entered your own. The formulas stay.
• Keep the columns and their order. They follow the templates of Implementing Regulation (EU) 2024/2956, so that copying into your authority's submission format needs no rearranging.
• Add your own columns to the right of the calculated ones. Do not insert columns between the register columns, because the checks read them by position.
• If you hold the register in a contract management tool already, keep it there and paste its export into these sheets to run the checks. Keep one reference number for each arrangement for its whole life.
• Use your own values on the Lists sheet only where the Regulation lets you. The closed lists of the templates are fixed. If you define a meaning for a closed list, the submission format has a place for it (template B_99.01), and this working copy does not hold it.
• Rows are limited to the number the formulas cover. To add rows, copy a whole blank row (every column) to the bottom of the sheet's table. Check that the totals on the Checks sheet still equal the sum of the sheet's calculated columns.
This workbook is your own record. Keep a copy that can be reached when the main systems are down.
Checks
Settings, entity, findings and counts
Set the yellow cells, then read the findings and the counts. Working copy only: the official submission format follows Implementing Regulation (EU) 2024/2956. Each count is a number with the others named: no score and no percentage (DR-04).
Settings and the entity that keeps the register (template B_01.01)
| As-at date: the date the register is checked at | 30 Sep 2026 | Ended arrangements are worked out at this date (RV-05). EXAMPLE: 30 Sep 2026. Type a date, never a formula. | ||
| B_01.01.0010 LEI of the financial entity maintaining the register of information | EXMP00LANTERNPAY0158 | |||
| B_01.01.0020 Name of the financial entity | Lantern Pay Services (EXAMPLE) | |||
| B_01.01.0030 Country of the financial entity | IE | |||
| B_01.01.0040 Type of financial entity | 2 | Payment institution (including an exempted payment institution) | Option number of the Regulation's list. The name is calculated. | |
| B_01.01.0050 Competent authority [conditional] | [[competent authority designated under DORA Article 46]] | Required when reporting. Your authority's instructions name it (DR-21). | ||
| B_01.01.0060 Date of the reporting [conditional] | 27 Mar 2026 |
Findings of the checks RV-01 to RV-12
| Check | Kind | Findings | Result | Columns read, and the sheet that runs the check |
|---|---|---|---|---|
| RV-01: Every arrangement has a reference number, and no number is used twice | Data | 0 | No finding | B_02.01.0010. Arrangements. |
| RV-02: The type of arrangement is 1, 2 or 3; a subsequent or associated arrangement names an overarching arrangement that exists, and the others name none | Data | 0 | No finding | B_02.01.0020, B_02.01.0030. Arrangements. |
| RV-03: Every provider and subcontractor has a code of the right kind: a valid LEI or an EUID for a legal person (the LEI only if it is established outside the Union), and a country code with CRN, VAT, PNR or NIN for an individual acting in a business capacity | Data | 1 | Data finding: fix before submission (DR-08) | B_05.01.0010, B_05.01.0020, B_05.01.0070, B_05.01.0080. Providers. |
| RV-04: The type of ICT service is one of S01 to S19 | Data | 0 | No finding | B_02.02.0060. Arrangements. |
| RV-05: Dates are in the form yyyy-mm-dd; the end date is not before the start date and is 9999-12-31 where there is no end; an arrangement that has ended carries a reason | Data | 0 | No finding | B_02.02.0070, B_02.02.0080, B_02.02.0090. Arrangements. |
| RV-06: Every arrangement names a function that is in the function list, and every function has a criticality assessment from the closed list, a date for it and recovery objectives in hours | Data | 0 | No finding | B_02.02.0050, B_06.01.0060, B_06.01.0080, B_06.01.0090, B_06.01.0100. Arrangements and Functions. |
| RV-07: An arrangement that supports a critical or important function, or whose function is not yet assessed, has its notice periods in calendar days, the countries of governing law and of provision, whether data are stored and where, the sensitiveness of the data and the level of reliance | Data | 0 | No finding | B_02.02.0100 to B_02.02.0180. Arrangements. |
| RV-08: Every arrangement has its direct provider at rank 1 in the supply chain; a higher rank names the recipient of the subcontracted service; ranks are whole numbers from 1 | Data | 0 | No finding | B_05.02.0010, B_05.02.0050, B_05.02.0060. Arrangements and Supply chain. |
| RV-09: Every arrangement that supports a critical or important function, or whose function is not yet assessed, has a full assessment: substitutability, the reason where it is hard or impossible to substitute, the date of the last audit, whether an exit plan exists, reintegration, impact of discontinuing, and whether alternatives are identified | Data | 0 | No finding | B_07.01.0010 to B_07.01.0110. Arrangements. |
| RV-10: A cost has a currency, and every arrangement's provider is in the provider list with the same code | Data | 0 | No finding | B_02.01.0040, B_02.02.0030, B_02.02.0040. Arrangements. |
| RV-11: Every function is assessed as critical or important or not: none is left at 'Assessment not performed' | Duty | 0 | No finding | B_06.01.0060. Functions. |
| RV-12: Every arrangement that supports a critical or important function has an exit plan | Duty | 1 | Duty not met: enter it in the gap tracker (DR-06) | B_07.01.0080. Arrangements. |
A check counts the findings it makes, which can be more than one on a row. The Result column of each sheet names the checks that fail on a row.
Counts for the report (DR-04)
| Count | Number | What it counts | |
|---|---|---|---|
| Arrangements in the register | 7 | Rows in use on the Arrangements sheet. | |
| Arrangements treated as supporting a critical or important function (DR-10) | 1 | Arrangements whose function is assessed as critical or important, or is not yet assessed. | |
| of which the function is assessed as critical or important | 1 | Arrangements whose function is assessed Yes (B_06.01.0060). | |
| of which the function is not yet assessed | 0 | Arrangements whose function is at Assessment not performed. Treated as critical or important until assessed (DR-10). | |
| Subcontractor rows in the supply chain (rank above 1) | 1 | Rows on the Supply chain sheet with a rank above 1. | |
| Data findings (RV-01 to RV-10) | 1 | Findings of RV-01 to RV-10, which break the Implementing Regulation's own rules. | |
| Duty findings (RV-11 and RV-12) | 1 | Findings of RV-11 and RV-12, which show a duty that is not met. | |
| Arrangements with at least one finding | 1 | Distinct reference numbers with at least one finding on any sheet. |
In words (for the report)
1 of 7 arrangements support a critical or important function, and 0 more are treated as critical or important until their function is assessed.
The register has 1 open data finding (DR-08): 1 of 7 arrangements have at least one finding. 1 duty finding: enter it in the gap tracker (DR-06).
Functions
EXAMPLE: 4 functions as at 30 Sep 2026. Template B_06.01 (functions identification). Yellow columns are inputs; white columns calculate.
Working copy only: the official submission format follows Implementing Regulation (EU) 2024/2956.
| Example | B_06.01.0010 Function Identifier | B_06.01.0020 Licenced activity | B_06.01.0030 Function name | B_06.01.0040 LEI of the financial entity | B_06.01.0060 Criticality or importance assessment | B_06.01.0070 Reasons for criticality or importance [optional] | B_06.01.0080 Date of the last assessment of criticality or importance | B_06.01.0090 Recovery time objective of the function | B_06.01.0100 Recovery point objective of the function | B_06.01.0110 Impact of discontinuing the function | Row in use (calc) | RV-06 findings (calc) | RV-11 findings (calc) | Result (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | F-01 | Activities listed in Annex I to Directive (EU) 2015/2366 | Execution of payment transactions for merchants | EXMP00LANTERNPAY0158 | Yes | Disruption would stop merchants' payments and would put the conditions of the entity's authorisation at risk | 4 Mar 2026 | 4 | 1 | High | 1 | No finding | ||
| EXAMPLE | F-02 | Activities listed in Annex I to Directive (EU) 2015/2366 | Merchant onboarding and screening | EXMP00LANTERNPAY0158 | No | New merchants can wait for a day or two without harm to existing business | 4 Mar 2026 | 24 | 4 | Medium | 1 | No finding | ||
| EXAMPLE | F-03 | support functions | Finance and reconciliation | EXMP00LANTERNPAY0158 | No | Reconciliation can run late by several days | 4 Mar 2026 | 48 | 24 | Medium | 1 | No finding | ||
| EXAMPLE | F-04 | support functions | Corporate support: email, collaboration and network | EXMP00LANTERNPAY0158 | No | Staff can use fallback channels | 4 Mar 2026 | 72 | 24 | Low | 1 | No finding |
Providers
EXAMPLE: 7 providers and subcontractors as at 30 Sep 2026. Template B_05.01 (ICT third-party service providers). The EXAMPLE codes begin EXMP00 and identify no real company.
Working copy only: the official submission format follows Implementing Regulation (EU) 2024/2956.
| Example | B_05.01.0010 Identification code of ICT third-party service provider | B_05.01.0020 Type of code to identify the ICT third-party service provider | B_05.01.0030 Additional identification code of ICT third-party service provider [optional] | B_05.01.0040 Type of additional identification code to identify the ICT third-party service provider [conditional] | B_05.01.0050 Legal name of the ICT third-party service provider | B_05.01.0060 Name of the ICT third-party service provider in Latin alphabet | B_05.01.0070 Type of person of the ICT third-party service provider | B_05.01.0080 Country of the ICT third-party service provider’s headquarters | B_05.01.0090 Currency of the amount reported in B_05.01.0070 [conditional] | B_05.01.0100 Total annual expense or estimated cost of the ICT third-party service provider [conditional] | B_05.01.0110 Identification code of the ICT third-party service provider’s ultimate parent undertaking [conditional] | B_05.01.0120 Type of code to identify the ICT third-party service provider’s ultimate parent undertaking [conditional] | Subcontractor of arrangement (working column, not in the Regulation) | Behind a critical or important service (working column, not in the Regulation) | Row in use (calc) | LEI check digits (calc) | RV-03 findings (calc) | Result (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | EXMP00PAYPLATFORM177 | LEI | Platform Provider A (EXAMPLE) | Platform Provider A (EXAMPLE) | 1 | NL | EUR | 410,000 | EXMP00PLATFORMHLD173 | LEI | 1 | Valid | No finding | |||||
| EXAMPLE | EXMP00MAILSAAS000136 | LEI | Email and Collaboration Provider B (EXAMPLE) | Email and Collaboration Provider B (EXAMPLE) | 1 | IE | EUR | 38,000 | EXMP00MAILSAAS000136 | LEI | 1 | Valid | No finding | |||||
| EXAMPLE | EXMP00LEDGERSAAS0161 | LEI | Accounting Software Provider C (EXAMPLE) | Accounting Software Provider C (EXAMPLE) | 1 | DE | EUR | 24,000 | EXMP00LEDGERSAAS0161 | LEI | 1 | Valid | No finding | |||||
| EXAMPLE | EXMP00IDDATAPROV0168 | LEI | Identity Data Provider D (EXAMPLE) | Identity Data Provider D (EXAMPLE) | 1 | LU | EUR | 52,000 | EXMP00IDDATAPROV0168 | LEI | 1 | Valid | No finding | |||||
| EXAMPLE | EXMP00SECMONITOR0186 | LEI | Security Monitoring Provider E (EXAMPLE) | Security Monitoring Provider E (EXAMPLE) | 1 | IE | EUR | 96,000 | EXMP00SECMONITOR0186 | LEI | 1 | Valid | No finding | |||||
| EXAMPLE | EXMP00NETCARRIER0195 | LEI | Network Carrier F (EXAMPLE) | Network Carrier F (EXAMPLE) | 1 | IE | EUR | 31,000 | EXMP00NETCARRIER0195 | LEI | 1 | Valid | No finding | |||||
| EXAMPLE | Hosting Subcontractor G (EXAMPLE) | Hosting Subcontractor G (EXAMPLE) | 1 | US | CA-001 | Yes | 1 | 1 | RV-03 |
Arrangements
EXAMPLE: 7 arrangements as at 30 Sep 2026. Templates B_02.01, B_02.02 and B_07.01, one row for each arrangement. Their shared columns (reference number, provider code and type, type of ICT service) appear once.
Working copy only: the official submission format follows Implementing Regulation (EU) 2024/2956. Working columns are not in the Regulation. Calculated columns are on the right. Enter dates as dates.
| Example | B_02.01.0010 Contractual arrangement reference number | B_02.01.0020 Type of contractual arrangement | B_02.01.0030 Overarching contractual arrangement reference number | B_02.01.0040 Currency of the amount reported in B_02.01.0050 | B_02.01.0050 Annual expense or estimated cost of the contractual arrangement for the past year | B_02.02.0020 LEI of the financial entity making use of the ICT service(s) | B_02.02.0030 Identification code of the ICT third-party service provider | B_02.02.0040 Type of code to identify the ICT third-party service provider | B_02.02.0050 Function identifier | B_02.02.0060 Type of ICT services | B_02.02.0070 Start date of the contractual arrangement | B_02.02.0080 End date of the contractual arrangement | B_02.02.0090 Reason of the termination or ending of the contractual arrangement [conditional] | B_02.02.0100 Notice period for the financial entity making use of the ICT service(s) [conditional] | B_02.02.0110 Notice period for the ICT third-party service provider [conditional] | B_02.02.0120 Country of the governing law of the contractual arrangement [conditional] | B_02.02.0130 Country of provision of the ICT services [conditional] | B_02.02.0140 Storage of data [conditional] | B_02.02.0150 Location of the data at rest (storage) [conditional] | B_02.02.0160 Location of management of the data (processing) [conditional] | B_02.02.0170 Sensitiveness of the data stored by the ICT third-party service provider [conditional] | B_02.02.0180 Level of reliance on the ICT service supporting the critical or important function. [conditional] | B_07.01.0050 Substitutability of the ICT third-party service provider | B_07.01.0060 Reason where the ICT third-party service provider is considered not substitutable or difficult to be substitutable [conditional] | B_07.01.0070 Date of the last audit on the ICT third-party service provider | B_07.01.0080 Existence of an exit plan | B_07.01.0090 Possibility of reintegration of the contracted ICT service | B_07.01.0100 Impact of discontinuing the ICT services | B_07.01.0110 Are there alternative ICT third-party service providers identified? | B_07.01.0120 Identification of alternative ICT TPP [optional] | Service processes data (working column, not in the Regulation) | Row in use (calc) | Function row in the Functions sheet (calc) | Criticality of its function (calc) | Treated as critical or important (DR-10, calc) | What it needs (DR-11, calc) | RV-01 findings (calc) | RV-02 findings (calc) | RV-04 findings (calc) | RV-05 findings (calc) | RV-06 findings (calc) | RV-07 findings (calc) | RV-08 findings (calc) | RV-09 findings (calc) | RV-10 findings (calc) | RV-12 findings (calc) | Findings on this row (calc) | Findings on this reference, all sheets (calc) | Result (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | CA-001 | 1 | EUR | 410,000 | EXMP00LANTERNPAY0158 | EXMP00PAYPLATFORM177 | LEI | F-01 | S19 | 1 May 2022 | 30 Apr 2027 | 180 | 365 | IE | NL | Yes | NL | NL | High | Full reliance | Highly complex substitutability | Migration or reintegration is hard | 17 Feb 2026 | No | Highly complex | High | No | Yes | 1 | 1 | Yes | Yes | B_07.01 assessment; Article 30(3) contract terms; Exit plan (Article 28(8)); Subcontracting assessment (RTS 2025/532); Concentration check (Article 29); Tell the competent authority before signing (Article 28(3)) | 1 | 1 | 1 | RV-12 | ||||||||||||
| EXAMPLE | CA-002 | 1 | EUR | 38,000 | EXMP00LANTERNPAY0158 | EXMP00MAILSAAS000136 | LEI | F-04 | S19 | 1 Jan 2023 | 31 Dec 9999 | 1 | 4 | No | No | Article 30(1) and (2) contract terms | No finding | ||||||||||||||||||||||||||||||||
| EXAMPLE | CA-003 | 1 | EUR | 24,000 | EXMP00LANTERNPAY0158 | EXMP00LEDGERSAAS0161 | LEI | F-03 | S19 | 1 Jul 2023 | 30 Jun 2027 | 1 | 3 | No | No | Article 30(1) and (2) contract terms | No finding | ||||||||||||||||||||||||||||||||
| EXAMPLE | CA-004 | 1 | EUR | 52,000 | EXMP00LANTERNPAY0158 | EXMP00IDDATAPROV0168 | LEI | F-02 | S05 | 1 Feb 2024 | 31 Jan 2027 | 1 | 2 | No | No | Article 30(1) and (2) contract terms | No finding | ||||||||||||||||||||||||||||||||
| EXAMPLE | CA-005 | 1 | EUR | 96,000 | EXMP00LANTERNPAY0158 | EXMP00SECMONITOR0186 | LEI | F-04 | S04 | 1 Sep 2024 | 31 Aug 2027 | 1 | 4 | No | No | Article 30(1) and (2) contract terms | No finding | ||||||||||||||||||||||||||||||||
| EXAMPLE | CA-006 | 2 | EUR | 0 | EXMP00LANTERNPAY0158 | EXMP00NETCARRIER0195 | LEI | F-04 | S11 | 1 Jan 2022 | 31 Dec 9999 | 1 | 4 | No | No | Article 30(1) and (2) contract terms | No finding | ||||||||||||||||||||||||||||||||
| EXAMPLE | CA-007 | 3 | CA-006 | EUR | 31,000 | EXMP00LANTERNPAY0158 | EXMP00NETCARRIER0195 | LEI | F-04 | S10 | 1 Jan 2025 | 31 Dec 2027 | 1 | 4 | No | No | Article 30(1) and (2) contract terms | No finding |
Supply chain
EXAMPLE: 8 rows as at 30 Sep 2026. Template B_05.02 (ICT service supply chain): one row for each provider in the chain of an arrangement, rank 1 for the direct provider.
Working copy only: the official submission format follows Implementing Regulation (EU) 2024/2956.
| Example | B_05.02.0010 Contractual arrangement reference number | B_05.02.0020 Type of ICT services | B_05.02.0030 Identification code of the ICT third-party service provider | B_05.02.0040 Type of code to identify the ICT third-party service provider | B_05.02.0050 Rank | B_05.02.0060 Identification code of the recipient of sub-contracted ICT services [conditional] | B_05.02.0070 Type of code to identify the recipient of sub-contracted ICT services [conditional] | Name of the provider (working column, not in the Regulation) | Row in use (calc) | RV-08 findings (calc) | Result (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | CA-001 | S19 | EXMP00PAYPLATFORM177 | LEI | 1 | Platform Provider A (EXAMPLE) | 1 | No finding | |||
| EXAMPLE | CA-001 | S19 | 2 | EXMP00PAYPLATFORM177 | LEI | Hosting Subcontractor G (EXAMPLE) | 1 | No finding | |||
| EXAMPLE | CA-002 | S19 | EXMP00MAILSAAS000136 | LEI | 1 | Email and Collaboration Provider B (EXAMPLE) | 1 | No finding | |||
| EXAMPLE | CA-003 | S19 | EXMP00LEDGERSAAS0161 | LEI | 1 | Accounting Software Provider C (EXAMPLE) | 1 | No finding | |||
| EXAMPLE | CA-004 | S05 | EXMP00IDDATAPROV0168 | LEI | 1 | Identity Data Provider D (EXAMPLE) | 1 | No finding | |||
| EXAMPLE | CA-005 | S04 | EXMP00SECMONITOR0186 | LEI | 1 | Security Monitoring Provider E (EXAMPLE) | 1 | No finding | |||
| EXAMPLE | CA-006 | S11 | EXMP00NETCARRIER0195 | LEI | 1 | Network Carrier F (EXAMPLE) | 1 | No finding | |||
| EXAMPLE | CA-007 | S10 | EXMP00NETCARRIER0195 | LEI | 1 | Network Carrier F (EXAMPLE) | 1 | No finding |
Lists
| ListArrType | ListArrTypeMeaning | ListService | ListServiceName | ListCrit | ListSubst | ListReason | ListReint | ListImpact | ListSens | ListReliance | ListYesNo | ListAlt | ListTermReason | ListPerson | ListCodeType | ListEU | ListEntityOpt | ListEntityName |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | 1 standalone arrangement | S01 | S01 ICT project management | Yes | Not substitutable | No real alternatives, or too complex | Easy | Low | Low | Not significant | Yes | Yes | Termination not for cause: expired or not renewed | 1 | LEI | AT | 1 | Credit institution |
| 2 | 2 overarching / master contractual arrangement | S02 | S02 ICT Development | No | Highly complex substitutability | Migration or reintegration is hard | Difficult | Medium | Medium | Low reliance | No | No | Termination for cause: provider in breach of law, regulation or contract | 2 | EUID | BE | 2 | Payment institution (including an exempted payment institution) |
| 3 | 3 subsequent or associated arrangement | S03 | S03 ICT help desk and first level support | Assessment not performed | Medium complexity in terms of substitutability | Both reasons | Highly complex | High | High | Material reliance | Assessment not performed | Termination for cause: impediments of the provider capable of altering the supported function | BG | 3 | Account information service provider | |||
| S04 | S04 ICT security management services | Easily substitutable | Assessment not performed | Full reliance | Termination for cause: weaknesses in the provider's management and security of sensitive data | HR | 4 | Electronic money institution (including an exempted one) | ||||||||||
| S05 | S05 Provision of data | Termination following a request by a competent authority | CY | 5 | Investment firm | |||||||||||||
| S06 | S06 Data analysis | Other | CZ | 6 | Crypto-asset service provider, or issuer of asset-referenced tokens | |||||||||||||
| S07 | S07 ICT, facilities and hosting services (excluding Cloud services) | DK | 7 | Crypto-asset service provider, or issuer of asset-referenced tokens | ||||||||||||||
| S08 | S08 Computation | EE | 8 | Central securities depository | ||||||||||||||
| S09 | S09 Non-Cloud Data storage | FI | 9 | Central counterparty | ||||||||||||||
| S10 | S10 Telecom carrier | FR | 10 | Trading venue | ||||||||||||||
| S11 | S11 Network infrastructure | DE | 11 | Trade repository | ||||||||||||||
| S12 | S12 Hardware and physical devices | GR | 12 | Manager of alternative investment funds | ||||||||||||||
| S13 | S13 Software licencing (excluding SaaS) | HU | 13 | Management company | ||||||||||||||
| S14 | S14 ICT operation management (including maintenance) | IE | 14 | Data reporting service provider | ||||||||||||||
| S15 | S15 ICT Consulting | IT | 15 | Insurance or reinsurance undertaking | ||||||||||||||
| S16 | S16 ICT Risk management | LV | 16 | Insurance, reinsurance or ancillary insurance intermediary | ||||||||||||||
| S17 | S17 Cloud services: IaaS | LT | 17 | Institution for occupational retirement provision | ||||||||||||||
| S18 | S18 Cloud services: PaaS | LU | 18 | Credit rating agency | ||||||||||||||
| S19 | S19 Cloud services: SaaS | MT | 19 | Administrator of critical benchmarks | ||||||||||||||
| NL | 20 | Crowdfunding service provider | ||||||||||||||||
| PL | 21 | Securitisation repository |
PT
RO
SK
SI
ES
SE
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Financial entity | An entity of the kinds listed in Article 2(1), points (a) to (t), of DORA, such as a credit institution, a payment institution, an investment firm or an insurance undertaking. ICT third-party service providers are not financial entities. DORA binds financial entities, except those Article 2(3) excludes and those a Member State excludes under Article 2(4). |
| ICT third-party service provider | An undertaking providing ICT services (DORA Art 3(19)). ICT services are digital and data services provided through ICT systems to one or more users on an ongoing basis, including hardware as a service, and excluding traditional analogue telephone services (Art 3(21)). |
| Arrangement | A contract, or a family of contracts, under which an ICT third-party service provider gives the entity ICT services. Each has a reference number the entity assigns. It is a standalone arrangement, an overarching or master arrangement, or a subsequent or associated arrangement (ITS 2956 B_02.01). |
| Register of information | The register of all contractual arrangements for ICT services, kept at entity level and, for groups, at sub-consolidated and consolidated level, in the templates of Implementing Regulation (EU) 2024/2956 (DORA Art 28(3)). It distinguishes arrangements that support critical or important functions from those that do not. |
| Supply chain | The sequence of contracts behind one ICT service: the direct provider has rank 1 and each subcontractor a higher rank (ITS 2956 Art 2). Subcontractors that effectively underpin a service supporting a critical or important function are in the register. |
| Critical or important function | A function whose disruption would materially impair the entity's financial performance, or the soundness or continuity of its services and activities, or whose discontinued, defective or failed performance would materially impair its continuing compliance with the conditions of its authorisation or its other duties under financial services law (DORA Art 3(22)). The entity decides which of its functions are critical or important, records why, and reviews the decision. |
| Exit plan | A documented plan to leave an arrangement for a service that supports a critical or important function without disrupting the business, without limiting regulatory compliance and without harming the continuity and quality of service to clients (DORA Art 28(8)). It is tested and reviewed periodically. |
| Critical ICT third-party service provider | A critical ICT third-party service provider: one the European Supervisory Authorities designate as critical for financial entities under DORA Article 31. A Lead Overseer oversees it. The ESAs publish the list and update it yearly. |
| Supplier | In this pack, an organisation that provides ICT services to a financial entity. DORA reaches a supplier that is not itself a financial entity through the contract the financial entity must write (Article 30) and the information the financial entity must collect, and, if the ESAs designate it as critical, through oversight. A financial entity that sells ICT services to another financial entity follows this pack for its own duties and is a supplier to that customer, which writes the Article 30 terms into the contract with it. |
| Working copy | Working copy only: the official submission format follows Implementing Regulation (EU) 2024/2956. This workbook builds and checks the content. The submission follows the Regulation's templates, file format, dates and channel, which your competent authority sets. |
| Rank | A natural number from 1. The direct provider is always 1 and a subcontractor is always higher (Implementing Regulation (EU) 2024/2956, Article 2). The lower the number, the closer the arrangement is to the financial entity. |
| LEI | Legal Entity Identifier: 20 characters, the last two digits being check digits under ISO 17442. The Providers sheet checks them. |
| EUID | European Unique Identifier. Its format is set outside Implementing Regulation (EU) 2024/2956. The Providers sheet checks only that it starts with a two-letter country code and has no spaces. Only an LEI identifies a legal person established outside the Union. |
| Function identifier | The code you give each function, for the combination of the entity's LEI, its licensed activity and the function (B_06.01.0010). The arrangement names it in B_02.02.0050. |
| Treated as critical or important | A working rule of this pack (DR-10), not a rule of DORA: an arrangement is handled as supporting a critical or important function until its function has been assessed as not critical or important. |
| Data finding | A finding of RV-01 to RV-10: the register breaks a rule of the Implementing Regulation. The register shows none before it is submitted (DR-08). |
| Duty finding | A finding of RV-11 or RV-12: the register is valid and shows that a duty is not met, such as a function not assessed or no exit plan for a critical or important arrangement. |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| Working column | A column this workbook adds to the Regulation's columns, for the checks. The submission format has no column for it. |
| RV-nn, DR-nn, FD-nn | Checks of this register, rules of the pack and terms to ask of a supplier. DORA Proportionality & Scope Assessment, DORA Readiness Self-Assessment and DORA Gap & Remediation Tracker use the same IDs. |
| EXAMPLE | A worked example: Lantern Pay Services (EXAMPLE) as at 30 Sep 2026. Every name, code and value is made up. Delete before use. |
Templates of the Regulation and what a single entity does with each
| Template | Name, when it is used and where this workbook holds it |
|---|---|
| B_01.01 | Entity maintaining the register of information. Always. Held on the Checks sheet, with all 6 of its columns. Each column header carries its code, and a note on the header gives its type and when it is required. |
| B_01.02 | List of entities within the scope of consolidation. Always: an entity that is not in a group reports only itself. Not held in this working copy (11 columns). Complete it in the submission format. |
| B_01.03 | List of branches. Only if the entity has branches outside its home country. Not held in this working copy (4 columns). Complete it in the submission format. |
| B_02.01 | Contractual arrangements – general information. Always. Held on the Arrangements sheet, with all 5 of its columns. Each column header carries its code, and a note on the header gives its type and when it is required. |
| B_02.02 | Contractual arrangements – specific information. Always. Held on the Arrangements sheet, with its columns except 0010, which is the reference number of B_02.01.0010, and with 0020 calculated from the entity's LEI. Each column header carries its code, and a note on the header gives its type and when it is required. |
| B_02.03 | List of intra-group contractual arrangements. Only where part of a supply chain is intra-group. Not held in this working copy (2 columns). Complete it in the submission format. |
| B_03.01 | Entities signing the contractual arrangements for receiving ICT service(s) or on behalf of the entities making use of the ICT service(s). Always. Not held in this working copy (2 columns). Complete it in the submission format. |
| B_03.02 | ICT third-party service providers signing the contractual arrangements for providing ICT service(s). Always. Not held in this working copy (3 columns). Complete it in the submission format. |
| B_03.03 | Entities signing the contractual arrangements for providing ICT service(s) to other entities within the scope of consolidation. Only for groups. Not held in this working copy (2 columns). Complete it in the submission format. |
| B_04.01 | Entities making use of the ICT services. Always. Not held in this working copy (4 columns). Complete it in the submission format. |
| B_05.01 | ICT third-party service providers. Always. Held on the Providers sheet, with all 12 of its columns. Each column header carries its code, and a note on the header gives its type and when it is required. |
| B_05.02 | ICT service supply chain. Always. Held on the Supply chain sheet, with all 7 of its columns. Each column header carries its code, and a note on the header gives its type and when it is required. |
| B_06.01 | Functions identification. Always. Held on the Functions sheet, with all 10 of its columns. Each column header carries its code, and a note on the header gives its type and when it is required. |
| B_07.01 | Assessments of the ICT services. For each service supporting a critical or important function. Held on the Arrangements sheet, on the row of the arrangement, with its columns from 0050 on, because 0010 to 0040 repeat the reference number, provider code, type of code and type of ICT service already on the row. Each column header carries its code, and a note on the header gives its type and when it is required. |
| B_99.01 | Definitions from entities making use of the ICT services. Always: the entity's own meaning for the closed lists it uses. Not held in this working copy (0 columns). Complete it in the submission format. |
How to enter each group of columns
| Sheet and columns | What to enter |
|---|---|
| Functions: Function identifier and name | Give each function an identifier you keep for its life. List support functions as well as licensed activities (the template uses 'support functions' where no licensed activity applies). |
| Functions: Criticality or importance assessment | Choose Yes, No or Assessment not performed. Until a function is assessed, every arrangement behind it is treated as one that supports a critical or important function (DR-10). |
| Functions: Recovery time and recovery point objectives | Whole hours. Write 1 where the objective is under an hour and 0 where none is defined. Take them from your recovery objectives, and do not set a second set for the register. |
| Providers: Identification code and its type | A legal person needs a valid LEI or an EUID. An LEI is the only code allowed for a legal person established outside the Union. An individual acting in a business capacity uses a country code and CRN, VAT, PNR or NIN, for example FR_VAT. The sheet checks the LEI's check digits. |
| Providers: Subcontractors | List every subcontractor that underpins a service supporting a critical or important function, with its own code. Use the two working columns to say whose subcontractor it is. |
| Arrangements: Reference number, type and overarching arrangement | One reference number for each arrangement, unique and unchanged over time. Type 1 is a standalone arrangement, 2 an overarching or master arrangement and 3 a subsequent or associated one. A type 3 row names the reference number of its type 2 arrangement. |
| Arrangements: Provider code, function and type of ICT service | The provider's code and code type exactly as on the Providers sheet. The function identifier exactly as on the Functions sheet. The type of ICT service is S01 to S19 (see the Lists sheet). |
| Arrangements: Start and end dates | Dates in the form yyyy-mm-dd. Use 9999-12-31 where the arrangement has no end. An arrangement that has ended carries the reason. |
| Arrangements: Notice periods, countries, data and reliance | Required when the arrangement supports a critical or important function, or its function is not yet assessed. Notice periods are whole calendar days. Countries are two-letter codes. Say whether data are stored, where, how sensitive they are and how far the function relies on the service. |
| Supply chain: Rank | The direct provider is rank 1 on every arrangement. A subcontractor has a higher rank, and the row names the provider that receives its service. |
| Arrangements: Assessment of the service (B_07.01, the last columns) | One row for each arrangement that supports a critical or important function, or whose function is not yet assessed: substitutability, the reason where it is hard or impossible to substitute, the date of the last audit, whether an exit plan exists, reintegration, the impact of discontinuing and whether alternatives are identified. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.19 — Information security in supplier relationships | Arrangements and Providers sheets: the register of ICT suppliers and the contracts with them |
| ISO/IEC 27001:2022 | Annex A 5.22 — Monitoring, review and change management of supplier services | Arrangements and Checks sheets: the arrangements of each supplier's service are listed and their findings counted, for review |
| NIST CSF 2.0 | GV.SC-04 — “Suppliers are known and prioritized by criticality” | Functions and Arrangements sheets: suppliers known and ranked by whether the function they support is critical or important |
| DORA — Regulation (EU) 2022/2554 | Article 4 — financial entities implement the rules of Chapter II in line with proportionality, taking into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations; Chapters III, IV and V, Section I, apply proportionately “as specifically provided for in the relevant rules of those Chapters”; competent authorities consider how the entity applied proportionality when they review its ICT risk management framework on the reports submitted under Articles 6(5) and 16(2) | All sheets: how deep the register goes depends on what the entity is. The scope assessment decides which duties apply (DR-01) |
| DORA — Regulation (EU) 2022/2554 | Article 3(19) — “ICT third-party service provider” means “an undertaking providing ICT services” | Providers sheet: every row is an undertaking providing ICT services |
| DORA — Regulation (EU) 2022/2554 | Article 3(21) — “ICT services” means “digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services” | Arrangements sheet: the type of ICT service (S01 to S19) describes the service the arrangement covers |
| DORA — Regulation (EU) 2022/2554 | Article 3(22) — “critical or important function”: a function “the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities”, or whose discontinued, defective or failed performance would materially impair continuing compliance with the conditions and obligations of its authorisation or its other obligations under applicable financial services law | Functions sheet: the criticality or importance assessment of each function; RV-11 flags a function left unassessed |
| DORA — Regulation (EU) 2022/2554 | Article 5(3) — financial entities, other than microenterprises, “shall establish a role in order to monitor the arrangements concluded with ICT third-party service providers on the use of ICT services, or shall designate a member of senior management as responsible for overseeing the related risk exposure and relevant documentation” | Checks sheet: for financial entities other than microenterprises, the role or senior manager who monitors the arrangements keeps this register (Third-party arrangements owner) |
| DORA — Regulation (EU) 2022/2554 | Article 28(1) — ICT third-party risk managed as part of ICT risk, proportionately; the financial entity remains fully responsible | Arrangements sheet: the register is the starting point for managing ICT third-party risk as part of ICT risk |
| DORA — Regulation (EU) 2022/2554 | Article 28(3) — a register of information on all contractual arrangements for ICT services, distinguishing those supporting critical or important functions | Arrangements, Providers, Supply chain and Functions sheets: the register of information on all contractual arrangements, with those supporting critical or important functions distinguished |
| DORA — Regulation (EU) 2022/2554 | Article 28(3), third to fifth subparagraphs — financial entities report at least yearly to the competent authorities on the number of new arrangements, the categories of ICT third-party service providers, the type of contractual arrangements and the ICT services and functions provided; make the full register, or the sections requested, available on request; and inform the competent authority in a timely manner about any planned contractual arrangement on the use of ICT services supporting critical or important functions, and when a function has become critical or important | Checks sheet: counts of arrangements and of those supporting critical or important functions. The yearly report to the authority, its dates and its channel follow the authority's instructions (DR-21) |
| DORA — Regulation (EU) 2022/2554 | Article 28(4) — before entering into a contractual arrangement for ICT services, financial entities assess whether it covers a critical or important function, whether the supervisory conditions for contracting are met, and all relevant risks, including concentration risk; undertake due diligence on prospective providers; and identify and assess conflicts of interest | Arrangements sheet: the "treated as critical or important" and "what it needs" columns show which arrangements need the assessment before signing and the due diligence |
| DORA — Regulation (EU) 2022/2554 | Article 28(7) — financial entities ensure that contractual arrangements may be terminated for a significant breach of law, regulation or contract; for circumstances identified in monitoring that are capable of altering the performance of the functions provided; for evidenced weaknesses in the provider’s ICT risk management, in particular in how it ensures availability, authenticity, integrity and confidentiality of data; and where the competent authority can no longer effectively supervise the financial entity because of the arrangement | Arrangements sheet: the end date and the reason the arrangement ended (B_02.02.0090), whose options follow the grounds for termination |
| DORA — Regulation (EU) 2022/2554 | Article 28(8) — for ICT services supporting critical or important functions, financial entities put in place exit strategies that take account of provider failure, deteriorating quality, business disruption and termination; they must be able to exit without disruption to business activities, without limiting regulatory compliance and without detriment to the continuity and quality of services to clients; exit plans are comprehensive, documented and “sufficiently tested and reviewed periodically”, with alternative solutions, transition plans and contingency measures | Arrangements sheet: whether an exit plan exists (B_07.01.0080); RV-12 flags a critical or important arrangement without one |
| DORA — Regulation (EU) 2022/2554 | Article 29(1) — assessing concentration risk: providers not easily substitutable, or several arrangements with the same provider | Arrangements sheet: substitutability and alternative providers (B_07.01); filter the sheet by provider code to see several arrangements with one provider |
| DORA — Regulation (EU) 2022/2554 | Article 29(2) — where an arrangement for ICT services supporting critical or important functions allows subcontracting, financial entities weigh the benefits and risks, in particular for a subcontractor established in a third country; consider the insolvency law that would apply to the provider and any constraint on the urgent recovery of the entity’s data; consider data protection rules and effective enforcement of law where the provider is established in a third country; and assess whether long or complex subcontracting chains impair their ability to monitor the functions and the authority’s ability to supervise | Supply chain and Providers sheets: the subcontractors, their rank and the country of their headquarters |
| DORA — Regulation (EU) 2022/2554 | Article 30(1) — the rights and obligations of the financial entity and the ICT third-party service provider “shall be clearly allocated and set out in writing”; the full contract includes the service level agreements and is documented in one written document available on paper or in a downloadable, durable and accessible format | Arrangements sheet: one row for each written contract, with its dates, notice periods and countries |
| DORA — Regulation (EU) 2022/2554 | Article 30(2) — minimum contract content: services, locations, data protection, data return, service levels, incident assistance, cooperation with authorities, termination rights, training | Arrangements sheet: the countries of provision, storage and processing that the contract names |
| DORA — Regulation (EU) 2022/2554 | Article 30(3) — additional contract content for critical or important functions: full service levels, notice duties, contingency plans and security, testing participation, audit and access rights, exit strategies | Arrangements sheet: the "what it needs" column lists the Article 30(3) contract terms for arrangements treated as critical or important |
| DORA — Regulation (EU) 2022/2554 | Article 31(9) — the ESAs, through the Joint Committee, “shall establish, publish and update yearly the list of critical ICT third-party service providers at Union level”; a provider not on the list may ask to be designated (Article 31(11)) | Providers sheet: check each provider against the ESAs' yearly list of critical ICT third-party service providers. The working copy names no provider |
| DORA — Regulation (EU) 2022/2554 | Article 31(12) — financial entities may only use the services of an ICT third-party service provider established in a third country and designated as critical if it has established a subsidiary in the Union within 12 months of the designation | Providers sheet: the country of each provider's headquarters shows which are established outside the Union |
| DORA — Delegated Regulation (EU) 2024/1773 | Article 3 — the management body reviews the policy at least once a year; the policy sets a methodology to decide which ICT services support critical or important functions, assigns internal responsibilities for approving, managing, controlling and documenting the arrangements, identifies the role or senior manager that monitors them and the reporting lines to the management body, requires independent review of these services and their inclusion in the audit plan, and states that the arrangements do not relieve the entity and its management body of their responsibilities | Functions sheet: the list of functions records the result of the methodology your policy sets for deciding which services support critical or important functions |
| DORA — Delegated Regulation (EU) 2024/1773 | Article 5 — the policy requires that the entity defines its business needs, and carries out a risk assessment before the arrangement is concluded, covering operational, legal, ICT, reputational, data protection, data availability, data location, provider location and concentration risks | Arrangements sheet: data location, provider location and substitutability, which the risk assessment before the arrangement looks at |
| DORA — Delegated Regulation (EU) 2024/1773 | Article 6 — the policy sets a proportionate process for selecting and assessing prospective providers: business reputation, abilities, resources, information security standards, use of subcontractors, third-country location, consent to audits including on-site audits, and the level of assurance the entity requires, drawn from audits, independent audit reports, the provider’s internal audit reports, certifications or other information | Providers sheet: the identity, country and parent undertaking of each provider assessed at selection |
| DORA — Delegated Regulation (EU) 2024/1773 | Article 10 — the policy requires a documented exit plan for each contractual arrangement, with periodic review and testing, taking into account unforeseen and persistent service interruptions, inappropriate or failed service delivery and unexpected termination; the plan is realistic, feasible, based on plausible scenarios and reasonable assumptions, with an implementation schedule compatible with the termination terms | Arrangements sheet: whether an exit plan exists and whether the service can be reintegrated (B_07.01) |
| DORA — Implementing Regulation (EU) 2024/2956 | Article 2 — financial entities assign a rank to each ICT third-party service provider in the ICT service supply chain: a natural number from 1, where the direct provider is always 1 and a subcontractor is always higher than 1; the lower the number, the closer the arrangement is to the financial entity | Supply chain sheet: rank 1 for the direct provider and a higher rank for each subcontractor (RV-08) |
| DORA — Implementing Regulation (EU) 2024/2956 | Article 3 — the templates of Annexes I to IV are used at entity, sub-consolidated and consolidated level; they cover all ICT services of direct providers and all subcontractors that effectively underpin services supporting critical or important functions or material parts of them; information is accurate, consistent and regularly reviewed, with errors promptly corrected, and meets the data quality principles of accuracy, completeness, consistency, integrity, uniformity and validity; each provider that is a legal person is identified with a valid and active LEI or an EUID (both where available), and subcontractors of services supporting critical or important functions use a valid and active LEI or provide their EUID | Providers sheet: a valid LEI or an EUID for every provider and for subcontractors behind critical or important services (RV-03); Checks sheet: the data findings |
| DORA — Implementing Regulation (EU) 2024/2956 | Article 4 — each template is a table with a set number of columns and any number of rows; each data element has a single value, and where more than one value is valid an additional row is added for each | All data sheets: each cell holds one value, and a second valid value goes on an additional row |
| DORA — Implementing Regulation (EU) 2024/2956 | Article 5 — the register holds templates B_01.01 (entity maintaining the register), B_01.02 (entities in the consolidation), B_01.03 (branches), B_02.01 and B_02.02 (contractual arrangements, general and specific), B_02.03 (intra-group arrangements), B_03.01 to B_03.03 (signing entities and providers), B_04.01 (entities using the services), B_05.01 (providers and subcontractors), B_05.02 (supply chain), B_06.01 (functions), B_07.01 (assessment of the ICT services) and B_99.01 (the entity’s own definitions of the closed lists); entities may add information for their own risk or contract management | Definitions sheet: which templates this working copy holds and which it leaves to the submission format |
| DORA — Implementing Regulation (EU) 2024/2956 | Annex I, templates B_02.01 and B_02.02 — each contractual arrangement has a unique reference number, assigned by the entity, that is consistent over time and across templates, and a type (standalone, overarching or master, or subsequent or associated); B_02.02 records the identification code and code type of the provider, the function identifier, the type of ICT service (S01 to S19 of Annex III), start and end dates (‘9999-12-31’ where indefinite), the reason for any termination, and, where the service supports a critical or important function, notice periods in calendar days, the country of the governing law, the country of provision, whether data are stored and where, and the sensitiveness of the data stored | Arrangements sheet: reference number, type, provider, function, service type, dates, notice periods, countries and data |
| DORA — Implementing Regulation (EU) 2024/2956 | Annex I, templates B_05.01 and B_05.02 — B_05.01 identifies each direct provider and subcontractor with an identification code and its type (LEI, EUID, or a country code with CRN, VAT, PNR or NIN for an individual acting in a business capacity), its legal name, its type of person, the country of its headquarters, the annual cost for direct providers and its ultimate parent undertaking; B_05.02 ranks the providers in each chain by contractual arrangement reference number and type of ICT service, and gives the recipient of the subcontracted services for ranks above 1 | Providers and Supply chain sheets: providers, subcontractors and their ranks |
| DORA — Implementing Regulation (EU) 2024/2956 | Annex I, template B_06.01 — each function has a function identifier for the combination of the entity’s LEI, licensed activity and function; the entity records the licensed activity (‘support functions’ where none), the function name, whether it is critical or important (Yes, No or Assessment not performed), the date of the last assessment, the recovery time objective and recovery point objective in hours (1 where under an hour, 0 where not defined) and the impact of discontinuing the function | Functions sheet: functions, criticality or importance, recovery time and recovery point objectives |
| DORA — Implementing Regulation (EU) 2024/2956 | Annex I, template B_07.01 — for ICT services supporting a critical or important function or a material part of one, the entity records the substitutability of the provider (not substitutable, highly complex, medium complexity or easily substitutable) and the reason where it is not or hardly substitutable, the date of the last audit, whether an exit plan exists, the possibility of reintegrating the service, the impact of discontinuing it, and whether alternative providers are identified | Arrangements sheet: substitutability, last audit, exit plan, reintegration, impact and alternatives (the last columns) |
| DORA — Implementing Regulation (EU) 2024/2956 | Annex III — types of ICT services, reported by identifier only: S01 ICT project management, S02 ICT development, S03 ICT help desk and first level support, S04 ICT security management services, S05 provision of data, S06 data analysis, S07 ICT, facilities and hosting services (excluding cloud), S08 computation, S09 non-cloud data storage, S10 telecom carrier, S11 network infrastructure, S12 hardware and physical devices, S13 software licensing (excluding SaaS), S14 ICT operation management (including maintenance), S15 ICT consulting, S16 ICT risk management, S17 cloud services: IaaS, S18 cloud services: PaaS, S19 cloud services: SaaS | Lists sheet and Arrangements sheet: the types of ICT service S01 to S19, reported by identifier |
| DORA — Delegated Regulation (EU) 2025/532 | Article 3 — before entering into the arrangement the entity decides whether the provider may subcontract an ICT service supporting a critical or important function, and does so only where it has assessed, among other conditions, that the provider can identify and notify all such subcontractors, that the subcontractor gives the entity and the authorities the same access and inspection rights, and that the entity has assessed the effect of a subcontractor’s failure, the location risks and concentration risk; it repeats parts of that assessment periodically (Article 3(2)) | Arrangements sheet: the "what it needs" column lists the subcontracting assessment; Supply chain sheet: the subcontractors involved |
| DORA — Delegated Regulation (EU) 2025/532 | Article 4 — the contract identifies which services supporting critical or important functions may be subcontracted and on what conditions, and states that the provider is responsible for subcontracted services and monitors them, its monitoring and reporting duties towards the entity, the locations of data processed by subcontractors, continuity throughout the chain, contingency plan and security requirements passed down, the same access, inspection and audit rights, and notice of material changes to subcontracting | Supply chain and Providers sheets: identity and location of the subcontractors that the contract must pass terms down to (FD-08) |
| DORA — technical standard, cited by number and title only | The European Supervisory Authorities designated the first critical ICT third-party service providers under DORA Article 31 and published the list on 18 November 2025 (ESMA news page of that date); the list is updated yearly (Article 31(9)) | Providers sheet: check each provider against the list. The working copy names no provider |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Regulation (EU) 2022/2554 (DORA); Delegated Regulations (EU) 2024/1772, 2024/1773, 2024/1774, 2025/301, 2025/532 and 2025/1190; Implementing Regulations (EU) 2024/2956 and 2025/302; as published in the Official Journal and read on 8 October 2026
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. They do not say that meeting one meets any DORA requirement.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.
Regulation (EU) 2022/2554 binds the financial entities of its Article 2(1), points (a) to (t), except those Article 2(3) excludes and any that a Member State excludes under Article 2(4). Articles 5 to 15 do not apply to the entities of its Article 16(1), which follow Article 16 and Title III of Delegated Regulation (EU) 2024/1774. Several duties do not apply to microenterprises, and the Regulation says where. It reaches an ICT third-party service provider through the contract with a financial entity and, for a provider designated as critical, through the oversight framework of Chapter V, Section II.
The Delegated and Implementing Regulations bind the same financial entities as the Regulation they supplement, for the articles each applies to. Title II of Delegated Regulation (EU) 2024/1774 is for the entities that follow Articles 5 to 15; its Title III is for the entities of DORA Article 16(1). Delegated Regulation (EU) 2025/1190 binds only the entities that a TLPT authority identifies.
The competent authority for each financial entity is the one DORA Article 46 names for its type. National law and the authority's own instructions set the dates and channels for the register of information and for reports. None of them is stated here.