Getting Ready for DORA

DORA (Regulation (EU) 2022/2554) has applied since January 17, 2025, and its ICT third-party risk provisions are where many financial entities are still exposed. The regulation requires a register of information covering every contractual arrangement with an ICT third-party provider, specific contractual clauses for services supporting critical or important functions, a concentration-risk assessment across the whole vendor landscape, and — for providers designated as critical — direct oversight by the European Supervisory Authorities. None of it is optional, and none of it can be delegated away just because the underlying service was outsourced.

In this session, we’ll show how the osapiens HUB turns the register of information and ongoing third-party oversight into a structured, maintainable process.

You will learn:

• DORA’s ICT third-party requirements: what the register of information actually has to contain, and where institutions are getting it wrong
• The real cost of getting this wrong — what current estimates say, and why third-party risk is the most expensive piece to retrofit
• Structuring vendor data, contractual clauses, and concentration-risk assessment inside the osapiens HUB