EIOPA · DORA135 - 3191

ICT third-party risk management (DORA)

Name: ICT third-party risk management (DORA): EIOPA Q&A — EU Financial Regulatory Q&A
Creator: European Insurance and Occupational Pensions Authority
License: https://creativecommons.org/licenses/by/4.0/

Regulation: (EU) 2022/2554 - Digital Operational Resilience Act (DORA)
Article: 28
Topic: ICT third-party risk management (DORA)
Submitted: 2024-11-20
Answered: 2025-07-25

More Q&As on this regulation →

Question

Is there a presumed timeline of the reissue of ITS regarding the standard template for the register of information referred to in article 28(3) DORA by the ESAs? Furthermore, is there a presumed timeline of adoption of the RTS on subcontracting ICT services supporting a critical or important function (legal basis being article 30(5) DORA)?

Background

As representatives of the financial entities to whom DORA applies, wishing to exercise the utmost diligence in assisting them in fulfilling the obligations imposed by EU law, we would appreciate a response on when we should expect progress on the DORA implementing acts.

Answer

The question has been rejected because it is out of scope of the regulatory Q&A process on DORA.

View original on European Insurance and Occupational Pensions Authority ↗

This Q&A is published by European Insurance and Occupational Pensions Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.