Article 28(3) requires it at entity and consolidated level, and Commission Implementing Regulation (EU) 2024/2956 sets the templates. Competent authorities collect it, so its data has to be complete and consistent.
The guide to SOC 2 and DORA third-party risk covers how provider reviews fit next to it.
Read more
Related terms
- DORA
- DORA is the EU Digital Operational Resilience Act, which sets ICT risk, incident, testing and third-party risk requirements for financial entities.
- Third-party risk management
- Third-party risk management is the work of identifying, assessing and monitoring the risks that vendors and other third parties bring to an organization.