Financial entities under DORA (banks, insurers, payment and investment firms) must keep a register of information on all contracts with ICT third-party providers (DORA Article 28). ICT providers that serve financial entities are often asked for the same data. CloudSignLab keeps these fields on each supplier.
Fill in the DORA fields
- Open Suppliers and open a supplier that provides an ICT service (or add one).
- In the section DORA register of information, fill in:
- Tick Supports a critical or important function if an outage of this provider would seriously affect a critical or important function of your business.
- Save. Changes to the function and substitutability are kept in the supplier's history.
Export the register
On Suppliers, click DORA register (CSV). The file lists every supplier with reference, name, LEI, ICT service, critical function, substitutability, country, data location, criticality, contract end, last assessment and status. It opens in Excel.
Good to know
- The official templates of the European Supervisory Authorities have more tables (for example contracts, entities and functions). The export is the core of the register and a good starting point for them.
- Major ICT incident reports go through Incidents, and resilience tests through Continuity exercises.
- Every download of the export is recorded in the audit log.