EIOPA · DORA219 - 3305

ICT third-party risk management (DORA)

Name: ICT third-party risk management (DORA): EIOPA Q&A — EU Financial Regulatory Q&A
Creator: European Insurance and Occupational Pensions Authority
License: https://creativecommons.org/licenses/by/4.0/

Regulation: (EU) 2022/2554 - Digital Operational Resilience Act (DORA)
Article: 30
Topic: ICT third-party risk management (DORA)
Submitted: 2025-03-26
Answered: 2025-08-08

More Q&As on this regulation →

Question

We read about European Commission's rejection of the RTS (2554) on Subcontracting stating that the draft RTS on Subcontracting exceeds the mandate given in Article 30(5) DORA https://finance.ec.europa.eu/document/download/9a7139d5-1cbf-4dca-a5cf-853467b375c7_en?filename=250124-letter-esas_en.pdfPlease advise when the 30(5)-related RTS is planned to be published.

Answer

This question has been rejected because it relates to acts which are under consultation, in the legislative process or not yet in force.

View original on European Insurance and Occupational Pensions Authority ↗

This Q&A is published by European Insurance and Occupational Pensions Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.