Digital service companies (DSC) · DORA

IT services & DORA: becoming a 'DORA-ready' ICT provider

DORA (EU Regulation 2022/2554), applicable since 17 January 2025, strengthens the digital operational resilience of financial entities and governs their third-party ICT providers. An IT services company serving banks, insurers, or other financial entities is directly affected by these requirements, which are passed down through contractual arrangements. This guide explains the status of third-party ICT provider, mandatory contractual clauses, the information register, and the regime for critical providers.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: DORA.
  • Any IT services company providing ICT services (managed services, cloud, development, maintenance) to financial entities is concerned as a third-party ICT provider.
  • Accepting DORA contractual clauses.
  • Cooperate on the information register.
  • Guarantee resilience.
  • The IT services company is not sanctioned as a financial entity, but a designated critical provider placed under supervision is exposed to periodic penalty payments of up to 1% of its average daily global turnover.

Regulatory deadlines

The key dates of this regulation.

January 2023

Entry into force

In force

January 2025

Application

In force

What does DORA cover?

DORA is built on five pillars: ICT risk management, incident management and reporting, resilience testing (including threat-led penetration testing for the most significant entities), management of third-party ICT provider risks, and information sharing. ICT providers are not financial entities, but they are governed under the fourth pillar.

Providers deemed critical to the financial system may be designated and placed under the direct supervision of the European supervisory authorities.

Is the 'Digital Service Companies (DSC)' sector concerned?

Any IT services company providing ICT services (managed services, cloud, development, maintenance) to financial entities is affected as a third-party ICT provider. It has no DORA obligations 'of its own' in the way a bank does, but must meet the requirements its clients are obliged to impose on it.

The more critical the service is to the client, the higher the requirements; designation as a critical provider leads to direct supervision.

Detailed obligations

Accept DORA contractual clauses.

Incorporate mandatory clauses: description of services, service levels, data location, audit and access rights, reversibility, sub-processing controls, and cooperation arrangements in the event of an incident.

Cooperate on the information register.

Provide the client with the information required to maintain their information register (model defined by technical standards).

Guarantee resilience

Demonstrate security, continuity and recovery measures commensurate with the criticality of the service provided.

Cooperate in the event of an incident

Notify and cooperate with the client for the management and reporting of ICT incidents within its own deadlines.

Preparing for supervision.

For a potentially critical provider: anticipate the requirements of direct supervision by European authorities.

Sanctions & risks

The IT services company is not sanctioned as a financial entity, but a designated critical provider placed under oversight is exposed to periodic penalty payments of up to 1% of its average daily global turnover. In the absence of compliance, the primary risk is the loss of contracts: financial entities must be able to demonstrate control over their providers.

Being 'DORA-ready' thus becomes a differentiating commercial argument in the financial market.

Application timeline

  • 1Application. DORA has been applicable since 17 January 2025.
  • 2Information register. Financial entities report their register to authorities; the IT service provider must supply the expected data.

Common mistakes in the sector

  • 1"DORA doesn't apply to me". Ignoring requirements while serving financial entities.
  • 2Refused clauses. Failing to address DORA clauses and losing regulated contracts.
  • 3Neglected reversibility. Failing to plan for data exit and restitution.
  • 4Unanticipated register. Being unable to provide the information expected by the client.

Practical case

An IT services company hosts and maintains a critical application for an insurer. Under DORA, the insurer requires an audit right, a reversibility clause, oversight of subcontracting, and the information needed for its register. The IT services company that anticipated these clauses retains the contract and uses it as a reference to approach other financial clients.

Compliance roadmap

  1. 1

    Identify financial clients. Map the financial entities served and the criticality of services provided.

  2. 2

    Adapt contracts. Incorporating mandatory DORA clauses into the relevant contracts.

  3. 3

    Preparing registry data. Structure the information to be provided to clients for their register.

  4. 4

    Strengthening resilience. Aligning security, continuity and testing with service criticality.

  5. 5

    Anticipate supervision. Assess the risk of being a critical service provider and prepare accordingly.

Frequently asked questions

Not in the same way as a financial entity: the IT service provider must meet the requirements that its financial clients are obliged to impose on it by contract, and cooperate with their information register.

Back to the Digital service companies (DSC) guideDigital service companies (DSC) & NIS2 Digital service companies (DSC) & GDPR Digital service companies (DSC) & AI Act

Take action on DORA

Free assessment or a chat with an expert dedicated to digital service companies (dsc).

Start my free assessment Talk to an expert

They already trust us

See how organisations in the digital service companies (dsc) sector secured their compliance with DCO.

See testimonials