What does "ICT third-party service provider" mean under DORA?
An undertaking that provides digital and data services on an ongoing basis to financial entities through contractual arrangements (e.g., cloud platforms, data analytics, software development, data center operations).
Last updated: 22 August 2026.
DORA is Regulation (EU) 2022/2554. It has applied since 17 January 2025 to 20 categories of licensed financial entity, from banks to crypto-asset service providers. It requires an ICT risk management framework, major incident reporting within 4 hours of classification, an annual register of ICT contracts, and threat-led penetration testing every three years.
Checked