The DORA ICT Third-Party Risk & Control Manual

ICT outsourcing can transfer service delivery, but not regulatory accountability. For financial institutions operating under the EU Digital Operational Resilience Act (DORA), the challenge is to demonstrate that third-party technology risks are understood, controlled, monitored and supported by credible evidence.

The DORA ICT Third-Party Risk & Control Manual turns that challenge into a practical implementation and assurance framework. It shows how to identify critical or important functions, map ICT service and subcontractor dependencies, perform risk-based provider due diligence, assess concentration and substitutability, negotiate appropriate contractual protections, maintain the DORA Register of Information, and monitor service and security risks throughout the contractual lifecycle.

The manual goes beyond a summary of legislation. It connects regulatory requirements to accountable controls, operating records and independent examination. Readers learn how to assess incident cooperation, recovery capability, access safeguards, resilience testing, transition assistance and exit readiness-and how to distinguish a documented control from evidence that the control actually works.

Built around a continuing fictional financial-institution case study, the book includes an 80-control practitioner framework, implementation worksheets, model contractual clauses, supplier due-diligence questions, audit work programs, findings and remediation templates, regulatory cross-reference tables, and a specialist glossary. Across 20 chapters and six appendices, it is designed for practical use rather than passive reading.

For ICT third-party risk managers, compliance and legal teams, procurement specialists, technology and security leaders, operational resilience professionals, and internal auditors seeking a structured, evidence-led approach to DORA implementation.