Same discipline, different industry
The EU Digital Operational Resilience Act (DORA) applies from January 17, 2025 (William Fry). Its rules on ICT third-party risk look familiar to anyone from supplier quality: select providers on documented criteria, write requirements into contracts, keep a register, monitor performance and plan for exit.
In financial institutions this work usually sits with ICT risk, vendor management or compliance. Supplier quality managers moving into financial services, or working at ICT providers that serve banks and insurers, bring exactly the skills DORA needs.
What DORA asks for, in supplier-quality terms
| DORA concept | Supplier quality equivalent | What is required (per Dutch AFM) |
|---|---|---|
| ICT third-party risk strategy | Supplier management policy | A strategy for third-party risk, regularly reviewed, as part of the ICT risk framework (microenterprises exempt) |
| Pre-contract analysis | Supplier selection | Assess required security level, audit frequency and scope, concentration risk, subcontracting effects and, for critical functions, an exit strategy |
| Register of information | Approved supplier list | Every ICT services contract recorded, showing whether it supports critical or important functions |
| Key contractual provisions (Article 30) | Quality agreement | Mandatory contract terms, with extra terms for critical or important functions |
| Exit strategy | Dual sourcing and phase-out plans | Required for providers supporting critical or important functions |
Source: AFM (Dutch Authority for the Financial Markets).
Pre-contract due diligence
AFM lists what firms should analyze before signing:
- The required ICT security level.
- The required frequency and scope of audits and inspections.
- Concentration risk.
- The effect of further subcontracting by the provider.
- An exit strategy where the provider supports critical or important functions, covering disruption, quality decline and early termination.
A supplier quality manager would recognize this as a risk-based selection checklist.
The register of information
Every ICT services contract must be recorded, with a flag for those supporting critical or important functions. Supervisors can request the register, and firms report on it at least yearly (William Fry). The register also has a wider role: the European Supervisory Authorities used data from these registers to designate critical ICT third-party providers, publishing the list on November 18, 2025 (EIOPA). Designated providers now fall under direct ESA oversight.
Data quality matters here as much as in any approved supplier list: incomplete or inconsistent entries undermine both the firm’s risk view and supervisory use.
Monitoring and audits
For critical or important functions, DORA contracts must give the financial entity rights of inspection and audit, provider reporting obligations and participation in contingency testing (AFM). That is the equivalent of second-party audit rights and performance reporting in a quality agreement.
Practical monitoring draws on:
- Service level performance against contract.
- Incident reports from the provider.
- Audit and certification evidence.
- Subcontractor changes.
- Results of business contingency testing.
Who you work with
- ICT risk and CISO teams: security requirements and incident handling.
- Procurement and vendor management: contracts and the register.
- Legal: Article 30 contract terms.
- Business owners: which functions are critical or important.
- Compliance: supervisory reporting.
Common weaknesses
- Register built once for the first submission and not maintained.
- Critical or important function flags applied inconsistently.
- Due diligence focused on security questionnaires, ignoring concentration and subcontracting.
- Exit strategies written but never tested.
- Audit rights in contracts that are never used.
Checklist
- ICT third-party risk strategy approved and reviewed
- Pre-contract analysis covers all five AFM points
- Register of information complete and reconciled to contracts
- Critical or important function flags justified
- Exit strategies for critical providers
- Monitoring cycle with defined evidence
How AskDona helps
ICT provider assessments involve questionnaires, contracts, certifications, SLA reports and audit reports. AskDona reads those documents against DORA requirements and your internal policy, and shows where each requirement is evidenced or missing, with page citations. Run a sample ICT provider assessment on one provider. AskDona shows the evidence; your ICT risk and compliance teams decide.
Editor’s note: DORA requirements are summarized from the Dutch AFM and a law-firm overview; check the regulation and its technical standards for exact obligations. Not legal advice. The role-to-DORA mapping is an analogy for career transfer, not a regulatory concept. The LinkedIn count was supplied by the client.
FAQ
When did DORA start to apply? January 17, 2025.
What is the register of information? A record of every ICT services contract, flagging those that support critical or important functions.
Were critical ICT providers designated? Yes. The ESAs published the list on November 18, 2025.
Do supplier quality skills transfer to DORA work? Largely yes: risk-based selection, contract requirements, monitoring and audits are the same disciplines.
References
All pages opened and checked by October 23, 2026.
| Source | Type | Used for |
|---|---|---|
| AFM: DORA third-party providers | Supervisor guidance | Strategy, due diligence, register, Article 30, exit |
| William Fry: DORA management of ICT third-party risk | Law firm analysis | Application date, register reporting |
| EIOPA: ESAs designate critical ICT third-party providers (Nov 18, 2025) | Supervisor press release | CTPP designation |