EIOPA · DORA 249 - 3377

ICT third-party risk management (DORA)

Name: ICT third-party risk management (DORA): EIOPA Q&A — EU Financial Regulatory Q&A
Creator: European Insurance and Occupational Pensions Authority
License: https://creativecommons.org/licenses/by/4.0/

Regulation: (EU) 2022/2554 - Digital Operational Resilience Act (DORA)
Article: N/A
Topic: ICT third-party risk management (DORA)
Submitted: 2025-07-04
Answered: 2025-11-21

More Q&As on this regulation →

Question

The company has several business lines. Only one is subject to DORA. If the external supplier provides services for only one business line not subject to DORA, should they be treated as ICT suppliers?

Answer

This question has been rejected because the matter falls within the scope of Q&A 136.

View original on European Insurance and Occupational Pensions Authority ↗

This Q&A is published by European Insurance and Occupational Pensions Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.