DORA ICT Third-Party Risk Management: The Technical Implementation Guide for 2026

Article 28(3) requires financial entities to maintain a register of all contractual arrangements with ICT third-party service providers. The register must include:

• Service classification. Whether the provider supports critical or important functions (higher risk category) or non-critical functions.
• Due diligence documentation. Pre-contractual and ongoing due diligence performed, including security assessments, certifications reviewed, and findings.
• Contractual provisions. Evidence that contracts include the Article 30 mandatory provisions (audit rights, incident notification, termination rights, data security standards).
• Monitoring records. Ongoing performance and security monitoring results, not just point-in-time assessments.
• Concentration risk analysis. Which critical functions would be affected if this provider failed or suffered a significant incident.

The ESAs (European Supervisory Authorities) have issued RTS under DORA specifying the minimum content requirements for the register. Financial entities should ensure their register meets the RTS specifications, not just the base Article 28 text.

Our full guide to DORA compliance and defensible resilience covers the register requirements in the context of the full DORA framework.

The most common gap in DORA third-party risk programmes is not the initial due diligence - organisations have generally built those processes. The gap is ongoing monitoring with verifiable evidence.

Article 28(9) requires financial entities to 'continuously monitor' third-party service providers that support critical or important functions. In practice, this means more than reviewing quarterly security reports and checking certifications are still valid. Regulators will ask: how do you know the ICT services your critical functions depend on have maintained their security posture?

For ICT providers that process or store financial entity data, the answer that satisfies this requirement is cryptographic data integrity monitoring: continuous verification that the data assets flowing from the provider to the financial entity have not been tampered with in transit or at the source.

This is where the supply chain integrity approach intersects directly with DORA Article 28 obligations. Rather than relying on the provider's self-reported security posture, financial entities can independently verify data integrity at the point of consumption.

ROOTKey's DORA compliance tools include the third-party integrity monitoring capabilities needed to satisfy Article 28(9)'s continuous monitoring requirement. Start your DORA readiness assessment.