Digital Operational Resilience Act (DORA), strengthens third-party risk management by targeting five key ways to identify, assess, and reduce concentration risk.
In our previous article, we explored the three core types of concentration risk Third Party Risk Management (TPRM) programs must manage: vendor, geographic, and service. Building on that, let’s look at how DORA, the EU regulation for financial entities, pushes firms to identify, assess, and reduce each of those risks.
Who Does DORA Apply To?
DORA applies to EU financial entities (and certain ICT providers that support them). It requires a register of critical third parties, limits over-reliance on a small number of providers, and elevates expectations for contracts, monitoring, and exit.
Definitions
- ICT = Information and Communications Technology—the systems and services (often third-party) that underpin your digital operations.
- CTPP = Critical ICT Third-Party Provider—an ICT vendor designated by European Supervisory Authorities (ESAs) for direct oversight due to systemic importance.
1) Enhanced Due Diligence & Risk Assessment
DORA raises the bar on what “good” due diligence looks like.
- Evaluate criticality of the ICT service and the single-point-of-failure risk (including fourth-/nth-party chains).
- Consider replaceability and realistic alternatives.
- Factor in third-country and subcontracting exposures into the risk rating.
- Align findings with your digital resilience strategy (not just a one-off checkbox).
What to update: Due Diligence Questionnaire (DDQ) content, risk-tiering logic, and inherent risk models to explicitly score concentration, substitutability, and chain risk.
2) Stronger ICT Contract Requirements
DORA expects contracts with ICT providers to be explicit and enforceable.
- Clear service scope, security obligations, and performance targets.
- Incident reporting timelines and defined Recovery Time Objective/Recovery Point Objective (RTO/RPO).
- Audit, testing, and access rights (including pen testing where proportionate).
- Data location/processing terms and portability assurances.
- Termination & exit clauses that work in practice (e.g., material breach, chronic under-performance).
Why this matters for concentration: When you’re heavily reliant on a single provider, operable termination and exit rights are the safety valve that lets you move without chaos.
3) Ongoing Monitoring & Vendor Diversification
DORA leans into a multi-vendor mindset where feasible.
- Monitor performance, incidents, resilience metrics, and subcontractors—not just once a year.
- Identify concentrations (by provider, region, service) and set thresholds that trigger remediation or diversification.
- Use portfolio-level dashboards to show where risk clusters are forming.
What to add: Portfolio heatmaps, trigger thresholds (e.g., “no single vendor >40% of X”), and remediation playbooks.
4) Oversight Framework for Critical ICT Third-Party Providers (CTPPs)
DORA creates a regulatory oversight lane for ICT providers designated as “critical” by the European Supervisory Authorities (ESAs).
- ESAs can designate providers critical based on systemic impact and substitutability.
- CTPPs face direct oversight, inspections, resilience testing, and corrective actions.
- Lead Overseers can issue recommendations; non-compliance can lead to penalties and force financial entities to suspend or exit services.
Practical takeaway: Monitor which of your vendors are or may become CTPPs—their status signals heightened scrutiny and elevated expectations for your program.
5) Exit Strategy & Termination Testing
DORA treats exit as a designed capability, not an afterthought.
- Maintain tested exit plans (data portability, transition support, knowledge transfer).
- Validate time-to-cutover, licensing contingencies, and access during wind-down.
- Test exits periodically—beyond normal BCP/DR—to prove you can detach from a concentration in practice.
What to test: Cloud/provider failover drills, escrow/portability of data and configs, role-based access during transition, and communications plans.
Putting It Into Practice (checklist)
- Register: Maintain an up-to-date critical third-party register with concentration indicators.
- Score: Add concentration, substitutability, and chain risk to inherent/overall risk scoring.
- Contract: Standardize DORA-ready clauses (audit, RTO/RPO, reporting, data location, termination/exit).
- Monitor: Build portfolio heatmaps with thresholds that trigger diversification or remediation.
- Exit: Test your exit and cutover scenarios—treat them like fire drills.
The Bottom Line
DORA doesn’t just ask you to document concentration risk—it expects you to design around it. If you operationalize these five areas, you’ll reduce single-point-of-failure exposure, improve negotiating leverage, and be ready when regulators (or your board) ask the only question that matters: “If this provider fails, can we carry on?”
This article is part of The TPRM Concentration Risk Playbook blog series, which explores how organizations can identify, assess, and mitigate concentration risk in third-party risk management programs.
How Can Schneider Downs Help?
Schneider Downs is a registered assessment firm with the Shared Assessments Group, the clear leader in third-party risk management guidance. Our personnel are experienced in all facets of vendor risk management, and have the credentials necessary (CTPRP, CISA, CISSP, etc.) to achieve meaningful results to help your organization effectively achieve new vendor risk management heights.
For more information contact the team at [email protected] or visit www.schneiderdowns.com/tprm.
