In this third article of our series on the EU’s Digital Operational Resilience Act (DORA), we look at the requirements imposed on financial services institutions when procuring ICT services from third parties. This article is written from the perspective of the financial services institutions themselves. However, it will
This
Managing ICT third-party risk under DORA
Requirements imposed on financial services institutions when procuring ICT services from third parties – regulation and best practice.
Critical third parties, Digital Operational Resilience Act, DORA, DORA Article 28, DORA Article 28(1)(b), DORA Article 3(18), DORA Article 3(21), DORA Article 3(5), DORA Article 30(1), DORA Article 30(2), DORA Article 4(2)t, DORA Recital 2, DORA Recital 29, DORA Recital 63, EBA, ESMA, EU, ICT risk, Network and Information Systems Regulations, NIS2, Operational resilience, PRA, Third-party risk management, UK