Art. 3 Governance arrangements | RTS on ICT third-party service provider policy | DORA

Article 3 is a substantive and detailed article that sets out the core content requirements for the policy introduced in Article 1.

It covers the governance, maintenance, and structural obligations that the policy must embed, spanning everything from how the policy is kept current, to how responsibilities are assigned internally, to how contractual arrangements with ICT third-party service providers must align with DORA's broader framework.

A key theme running throughout is accountability: the management body owns the policy, senior management is named as responsible for oversight, and the financial entity retains ultimate responsibility regardless of what is outsourced.

Important points:

Ensure your policy is reviewed by the management body at least once a year, updated where necessary, and that any changes are implemented in a timely manner with a documented timeline.
Embed clear internal governance into the policy, including named senior management responsibility for monitoring contractual arrangements, defined reporting lines to the management body, and assigned responsibilities for approval, management, control, and documentation.
Contractual arrangements with ICT third-party service providers must not relieve the financial entity of its regulatory obligations, must not obstruct supervisory access, and must align with DORA's ICT risk management, information security, business continuity, and incident reporting requirements.

1. The management body shall review the policy at least once a year and update it where necessary. Changes made to the policy shall be implemented in a timely manner and as soon as it is possible within the relevant contractual arrangements. The financial entity shall document the planned timeline for the implementation.
1. The policy shall establish or refer to a methodology for determining which ICT services support critical or important functions. The policy shall also specify when this assessment is to be conducted and reviewed.
1. The policy shall clearly assign the internal responsibilities for the approval, management, control, and documentation of relevant contractual arrangements and shall ensure that appropriate skills, experience and knowledge are maintained within the financial entity to effectively oversee the relevant contractual arrangements, including the ICT services provided under those arrangements.
1. Without prejudice to the final responsibility of the financial entity to effectively oversee relevant contractual arrangements, the policy shall require that the ICT third party service provider is assessed to have sufficient resources to ensure that the financial entity complies with all its legal and regulatory requirements regarding the ICT services supporting critical or important functions that are provided.
1. The policy shall clearly identify the role or member of senior management responsible for monitoring the relevant contractual arrangements. The policy shall specify how that role or member of senior management shall cooperate with the control functions, unless it is part of it, and shall set out the reporting lines to the management body, including the nature of the information to report and the documents to provide. It shall also set out the frequency of such reporting.
1. The policy shall ensure that the contractual arrangements are consistent with the following:
  1. the ICT risk management framework referred to in Article 6 of Regulation (EU) 2022/2554;
  2. the information security policy referred to in Article 9(4) of Regulation (EU) 2022/2554;
  3. the ICT business continuity policy referred to in Article 11 of Regulation (EU) 2022/2554;
  4. the requirements on incident reporting set out in Article 19 of Regulation (EU) 2022/2554.
1. The policy shall require that ICT services supporting critical or important functions provided by ICT third party service providers are subject to independent review and are included in the audit plan.
1. The policy shall explicitly specify that the contractual arrangements:
  1. do not relieve the financial entity and its management body of its regulatory obligations and its responsibilities to its clients;
  2. are not to prevent effective supervision of a financial entity and are not to contravene any supervisory restrictions on services and activities;
  3. are to require that the ICT third party service providers cooperate with the competent authorities;
  4. are to require that the financial entity, its auditors, and competent authorities have effective access to data and premises relating to the use of ICT services supporting critical or important functions.