Critical third-party providers must meet a number of requirements under the EU's Digital Operational Resilience Act
The list of organizations pulled into the scope of the EU's comprehensive ICT risk management framework, the Digital Operational Resilience Act (DORA), is set to extend far beyond the financial sectors. That's due to the provision outlining that critical third-party providers (CTPPs) have several key responsibilities to ensure they contribute to the industry's overall resilience. As a result, many suppliers to financial institutions are now confronting new cyber resiliency questions amidst a pressing DORA compliance deadline.
In an interconnected digital landscape where financial institutions increasingly rely upon external service providers to varying degrees, regulations such as DORA aim to bring operational resilience into focus and thus create new compliance obligations for many 'critical' suppliers to the sector.
Organizations ranging from data centers and telecommunications providers to software providers are already being informed that they fall into the 'critical third-party provider' criteria of financial institutions operating within the EU. However, many CISOs and security leaders across sectors are still uncertain as to their organization's CTPP status, but they must now begin to prepare for DORA ahead of the January 17 compliance deadline in 2025.
Key requirements:
DORA outlines that CTPPs have several key responsibilities. These responsibilities are designed to minimize risks associated with third-party dependencies and include:
• Risk Management: Implementing robust risk management frameworks to identify, assess, and mitigate operational risks associated with their services.
• Incident Reporting: Notify relevant authorities and affected financial institutions promptly about cyber incidents that could impact their services.
• Business Continuity: Establish and maintain effective business continuity plans to ensure the continuity of services, even in adverse situations.
• Resilience Testing: Conduct regular testing of their operational resilience, including simulations and stress tests, to validate their preparedness for potential disruptions.
• Collaboration: Engage in effective communication and collaboration with financial institutions and regulators to ensure transparency and a coordinated response to incidents.
• Third-Party Oversight: Monitor and manage risks associated with any third parties or subcontractors, ensuring they also meet necessary resilience standards.
Who is a CTPP under DORA?
DORA defines critical third-party providers as those service providers whose disruption could significantly impact the financial sector's ability to deliver essential functions, establishing criteria for determining the criticality of third-party providers based on factors such as:
- Size and importance
- Impact of disruption
- Market share
- Substitutability
- Nature of services
- Regulatory importance
The Regulatory Technical Standards (RTS) under DORA provide detailed guidance on classifying critical third-party providers (CTPPs) compared to non-critical third parties – CTPPs face more stringent requirements, including enhanced monitoring, incident reporting, and risk management expectations.
You can find more information on criteria and requirements for critical vs non-critical classifications in our Classification of Critical Third-Party Providers Under DORA information sheet.
Sectors in focus
Organizations – often from non-financial sectors such as technology, telecommunications, and media – are already being informed by financial institutions that they are critical third-party providers and must comply with DORA due to the essential nature of their services. Likely affected organizations include:
- Cloud service providers
- Data center and infrastructure service providers
- Data analytics companies
- Payment processors
- Software providers
- Telecommunications providers
Companies in these sectors should be prepared for such communications and take proactive steps to align with DORA requirements.
As financial services increasingly rely on digital technologies and services, technology and telecommunications companies, in particular, are becoming integral to their operations, raising their profile regarding regulatory oversight as a result. This makes it particularly important that cyber leaders and risk and compliance managers in these sectors proactively assess their role in the financial industry and prepare for potential compliance with DORA, even if they are still determining their current classification.
Proactive compliance steps for critical third-party providers
Where potential CTPPs are still awaiting clarity, replicating financial institutions' likely methods to determine their critical third parties is a valuable exercise to put your business on the front foot for DORA. Assess how your organization is expected to be viewed against key factors, replicating the structured approach most financial institutions will take:
Criticality: Evaluate the potential impact of losing your organization's service on the financial institution's operations – in terms of finance, service disruption, and customer impact. Determine if your services are essential for the financial institution's ability to deliver its critical functions.
Criteria Evaluation: Apply DORA's criteria for criticality, such as your size and importance, market share, and substitutability. How easily could the organization find alternatives if you (the supplier) failed?
Continuous Monitoring: Could shifts in your business operations or market conditions affect your future criticality? This may be picked up as financial institutions continuously review and reassess third-party relationships.
Even if your organization is uncertain about its DORA scope, taking steps to prepare now will help to ensure that the organization is ready to comply with DORA if it falls within the scope in the future, anticipating changes to regulatory requirements and minimizing the risk of non-compliance.
By demonstrating a commitment to operational resilience, third-party providers can also align with market expectations and make themselves more attractive partners for financial institutions. They can also foster trust with clients and manage their reputation in the industry. It is crucial for all organizations that resilience is not simply a regulatory objective.
Utilizing DORA as a framework for best practice also sets organizations up to manage risk better and handle potential disruptions. Implementing resilience measures reduces the risk of incidents that could impact clients and partners and improves overall operational efficiency, regardless of regulatory requirements.
About the author
Senior Security Consultant, NCC Group UK
NCC Group's DORA compliance guidance – from start to finish
To learn more about whether you could be in scope of DORA and receive insights on how to plug potential compliance gaps, take our complimentary DORA QuickCheck survey or reach out to our experts.