Regulation (EU) 2022/2554 has applied since 17 January 2025. Its third-party chapter requires assessment and monitoring of ICT providers, contract provisions in Article 30, and a register of information on every ICT arrangement.
The DORA framework page covers the regulation as a whole.
Read more
Related terms
- Register of information
- The register of information is the record DORA requires financial entities to keep of every contractual arrangement with an ICT third-party service provider.
- NIS2
- NIS2 is the EU directive that sets cybersecurity risk-management and incident-reporting obligations for essential and important entities in critical sectors.
- Third-party risk management
- Third-party risk management is the work of identifying, assessing and monitoring the risks that vendors and other third parties bring to an organization.