Third-Party Risk Management
The process of identifying, assessing, and controlling risks arising from outsourcing to third-party service providers. Under DORA Article 28, financial entities must maintain a register of all ICT third-party providers and conduct thorough due diligence on critical providers.
Third-party risk management has become one of the most critical aspects of compliance for financial institutions. DORA dedicates an entire pillar (Articles 28-44) to managing ICT third-party risk, reflecting the financial sector's increasing dependence on external technology providers including cloud services, SaaS platforms, and managed security services.
Key requirements include maintaining a comprehensive register of all ICT third-party service providers, conducting pre-contractual risk assessments, including mandatory contractual provisions (data location, audit rights, exit strategies), ongoing monitoring of provider performance and risk levels, and developing exit strategies for critical providers.
DORA also introduces a novel oversight framework for critical ICT third-party service providers (CTPPs). The European Supervisory Authorities can designate certain providers as critical and subject them to direct oversight, including the power to conduct inspections and impose penalties. This represents a significant expansion of regulatory reach into the technology supply chain.
Learn More
Discover how Matproof can help you achieve Third-Party Risk Management compliance.
View framework pageRelated Terms
DORA (Digital Operational Resilience Act)
An EU regulation that establishes uniform requirements for the security of network and information systems in the financial sector. DORA became mandatory on January 17, 2025, and applies to banks, insurance companies, investment firms, and their critical ICT service providers.
Supply Chain Security
The management of cybersecurity risks throughout the supply chain, including all third-party vendors, software providers, and service partners. Both DORA and NIS2 mandate supply chain security measures to protect against cascading failures and targeted attacks.
Vendor Risk Assessment
A structured evaluation of the security posture and compliance status of third-party vendors before and during a business relationship. DORA Article 28 mandates specific due diligence requirements for ICT service providers used by financial entities.
ICT Risk Management
The process of identifying, assessing, and mitigating risks associated with information and communication technology systems. Under DORA, financial entities must maintain a comprehensive ICT risk management framework covering identification, protection, detection, response, and recovery.
Automate compliance with Matproof
DORA, SOC 2, ISO 27001 — get audit-ready in weeks, not months.
Request a demo