Obligation to maintain a register of information for FEs exempt under article 16

DORA Recital 21 specifies that in order to maintain full control over ICT risk, financial entities need to have comprehensive capabilities to enable a strong and effective ICT risk management, as well as specific mechanisms and policies for handling all ICT-related incidents and for reporting major ICT-related incidents. It also states that the digital operational resilience baseline for financial entities should be increased while also allowing for a proportionate application of requirements for certain financial entities, particularly microenterprises, as well as financial entities subject to a simplified ICT risk management framework. In addition, DORA Recital 43 states that financial entities which qualify as microenterprises or are subject to the simplified ICT risk management framework under this Regulation should not be required to establish a role to monitor their arrangements concluded with ICT third-party service providers on the use of ICT services. However, DORA Article 28(3) establishes the obligation to maintain and update a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers with no exception. All financial entities that are subject to DORA are required to maintain a register of information. Additionally, they must apply third-party risk management framework that is proportional to the risks associated with their activities. This means that the extent and complexity of the risk management measures should match the level of risk involved. For example, smaller financial entities, which typically use fewer ICT services, would have simpler risk management requirements compared to larger entities. The principle of proportionality is already embedded in the requirements of the register of information, ensuring that the measures are appropriate for the size and complexity of the entity's operations.