DORA Third-Party ICT Risk: Infrastructure for Vendor Management and Concentration Risk

DORA Articles 28-44 create the most comprehensive ICT third-party risk framework in any regulation. Financial entities must maintain a register of all ICT third-party arrangements, assess concentration risk, and have exit strategies for critical providers. For infrastructure teams, this reshapes cloud and vendor architecture decisions.

The ICT Third-Party Register

DORA requires a register of ALL ICT service arrangements. Not just cloud providers — every SaaS tool, managed service, outsourced function, and data feed. Infrastructure to maintain this:

• Automated discovery — Network traffic analysis, SSO integration logs, procurement system integration to identify all ICT services in use
• Contract management platform — Structured storage of all ICT contracts with DORA-required metadata: service description, data locations, subcontractors, audit rights, exit provisions
• Continuous monitoring — SLA tracking, uptime monitoring, security posture assessment of third parties

Concentration Risk Management

DORA specifically addresses concentration risk — over-reliance on a single ICT provider. Infrastructure implications:

• Dependency mapping — Visualize which business functions depend on which providers. Identify single points of failure
• Multi-cloud architecture — Critical workloads deployable on at least two cloud providers. Kubernetes as the portability layer
• Alternative provider readiness — Pre-qualified alternative providers with tested migration procedures
• Subcontractor visibility — Your cloud provider uses other providers. Map the full chain

Exit Strategy Infrastructure

DORA requires documented, tested exit strategies for critical ICT providers:

• Data portability — Automated data export in standard formats, tested regularly
• Application portability — Container-based deployments, cloud-agnostic IaC, no proprietary service lock-in for critical functions
• Migration runbooks — Step-by-step procedures validated through dry runs
• Transition period infrastructure — Parallel-run capability during provider transition

The Oversight Framework for Critical Providers

ESAs can designate cloud providers as "critical ICT third-party service providers" subject to direct oversight. If your cloud provider is designated, they'll face direct supervisory scrutiny. Your infrastructure should already be portable — don't wait for designation to build exit capability.