Section IKey principles for a sound management of ICT third-party risk
- Article 28General principles
1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and…
- Article 29Preliminary assessment of ICT concentration risk at entity level
1. When performing the identification and assessment of risks referred to in Article 28(4), point (c), financial entities shall also take into account whether the envisaged conclusion of…
- Article 30Key contractual provisions
1. The rights and obligations of the financial entity and of the ICT third-party service provider shall be clearly allocated and set out in writing. The full contract…
https://dora.digiphile.law/chapter/chapter-V-section-I.html
Text as at 2 November 2026.
This is an unofficial convenience version of the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in November 2026.