CyberFinance

ICT Third-Party Risk & Register of Information

The DORA register regulators actually ask for, and the contract terms behind it.

The situation

The Register of Information is where DORA compliance becomes visible to the supervisor, and it is where most institutions are weakest: incomplete supplier inventories, missing contractual provisions under Article 30, undocumented subcontracting chains and no serious analysis of concentration risk.

We build the register from the underlying contracts, remediate the clauses, map the fourth-party chain and produce the annual submission.

What the client receives

Schedule of deliverables

01Complete ICT third-party inventory and critical-or-important function mapping
02Register of Information built to the ITS reporting template
03Article 30 contractual gap analysis and remediation clauses
04Subcontracting chain mapping (fourth-party risk)
05Concentration risk analysis and exit strategy per critical provider
06Annual register submission support

Frameworks and standards

Assessment is carried out against named references, so a conclusion can be traced back to the requirement it was measured against.

DORA Ch. V
Commission ITS on the Register of Information
EBA outsourcing guidelines
ISO/IEC 27036

CyberFinanceDORA Programme & Gap AssessmentFull-scope DORA compliance for financial entities and their critical ICT providers.Service detail CyberFinanceResilience Testing & TLPT AdvisoryPrepare for, scope and survive threat-led penetration testing.Service detail

Discuss this engagement

Tell us about the state of your register and the contracts behind it and we will set out the scope, the method and the reporting format.