What is DORA?
DORA is Regulation (EU) 2022/2554. It entered into force on 16 January 2023 and has applied since 17 January 2025. It sets rules for financial entities on ICT risk management, incident reporting, resilience testing and the management of ICT third-party risk.
A regulation applies directly in every member state. The European Supervisory Authorities (EBA, ESMA and EIOPA) publish technical standards, and each financial entity keeps a register of information on its contractual arrangements with ICT third-party providers. ICT providers designated as critical for the financial sector are overseen directly by the Authorities.
DORA defines ICT services broadly, as digital and data services provided through ICT systems on an ongoing basis, including hardware as a service and hardware services such as technical support through software or firmware updates by the hardware provider. Supervisory Q&A says each financial entity must assess for itself whether a service it uses is an ICT service. Whether on-site field work counts is therefore the customer's judgment, based on the nature of the service.
For ICT services DORA requires a written contract that sets out both sides' rights and obligations. The contract is expected to cover items such as a complete description of the services and whether and on what conditions subcontracting is allowed, the locations where services are provided and data is processed, data protection and the access, recovery and return of data, service levels, assistance with ICT incidents, cooperation with authorities and termination rights. Services that support critical or important functions carry additional requirements, including access, inspection and audit rights.
How it touches on-site IT work
- Contract and register: a financial customer has to document what each ICT provider does, so the scope needs a clear service description, the sites covered and the subcontractors involved.
- Subcontracting: field networks often use independent engineers or partner firms. A financial customer will want to know who they are and under what conditions they can be used.
- Work on critical systems: data center and comms room work touches servers, storage and network gear that may support critical or important functions. The customer will want change approvals, work records and evidence of each action.
- Incident support: financial entities must classify and report major ICT-related incidents to their competent authority, so they need fast, accurate information from providers. A failed change, damaged equipment or lost media on site should reach the customer through an agreed route.
- Audit and access rights: for critical or important functions the customer may ask for access and inspection rights, which can include reviewing how on-site work is done and recorded.
- Exit and return: contracts are expected to address termination and the return of data and assets, which matters for spares, media and documentation held by the provider.
What you can agree in a written scope
- A complete description of the services, the sites and the systems the provider will touch.
- Whether subcontracting is allowed, on what conditions, and the customer's right to be told of changes.
- Locations where services are performed and where any data, photos or records are stored.
- Service levels and response times, including how they are measured and reported.
- Assistance during ICT incidents: contact route, response time and what information the provider supplies.
- Work records and evidence, including change references, asset records and photos, and how long they are kept.
- Cooperation with the customer's regulators and auditors, within the limits of the engagement.
- Participation in the customer's security awareness or resilience training where it is relevant to the engineers on site.
- Termination rights, notice periods and the return or secure destruction of customer data, media and assets.
Questions to ask any field services provider
- Do you already work for financial entities, and can you support DORA contract terms?
- Which parts of the work are done by subcontractors or independent engineers, and under what conditions?
- How fast will you tell us about a failed change, damaged equipment or lost media?
- Will you accept audit and access rights for work that supports critical functions?
- Where are your work records, photos and tickets stored?
- How do you handle the return of our assets and data when we end the engagement?
- Can you join our incident calls and training when needed?
This page is general information and not legal advice. Deploris does not claim certification or compliance status here. Confirm what applies to you with your own counsel or compliance team.