How to Achieve Digital Operational Resilience Act (DORA) Compliance through Vendor and Contract Management

Vendor Communications and Compliance Checks

You also need to understand your current vendor segmentation. I’m aware that some of you won’t have defined vendor categories yet, but this process gives you a blank slate to work with, so do not worry about that.

We need to do this so we can easily reach out to every ICT vendor. One method would be to use Gatekeeper’s Workflow Engine to power up a DORA compliance workflow.

It will send out a DORA-specific questionnaire to every vendor to understand their intentions around compliance. This questionnaire might be as simple as asking if they expect to fall within the scope of DORA. If they do, you can ask a series of qualifying questions specific to the regulation.

From here, we’ll want to get insights into the subcontractors our vendors are using to map out our vendor base more effectively - especially as the new DORA contract requirements will need to flow down the supply chain.

We’ll also need to conduct collaborative risk management exercises, penetration testing, and more. It will require knowledge and visibility of Tier 2 to Tier N supply chains. Without this, DORA compliance will be difficult to achieve.

Build a Vendor Risk Register For The Digital Operational Resilience Act

As we start bringing new information from our ICT vendors into our organisation, we can officially categorise them. However, as we do this, we will likely uncover several vendor risks.

• Not yet started DORA preparations
• Poor sub-contractor visibility
• Business Continuity Plans and Disaster Recovery not compliant with DORA
• Contract Amendment Issues
• Concentration Risks with strategic vendors and mitigation plans for new vendors

There will be others, and we want to start documenting these as specific DORA risks. Fortunately, for every vendor that you have in Gatekeeper, you can create risks for them.

We covered this in our most recent webinar (non-DORA specific), but it’s worth watching to understand how you can improve your vendor compliance.

We could use the Risk Register to track anticipated or current incidents. We’ll need to create a specific category for these.

I’d suggest that we make it clear that every risk is DORA-related, but it depends on the team you have and the skills at your disposal as to your approach here.

We could simply create a new risk called: “DORA Risk”.

Or we could create a list of risks, as I’ve done before, and map these into Gatekeeper with the DORA prefix.

Either way, what you end up with is a detailed set of DORA-related risks that you can actively work on within your vendor base.

DORA Vendor Contracts

Existing vendor contracts are going to need updating and you’ll likely want to get a standard set of DORA clauses ready, much like you do for data protection.

Currently, there is no standard wording. However, the EU expects public authorities to develop standard clauses for this purpose and suggests financial services companies and ICT third-party vendors use such language.

Contracts under the Digital Operational Resilience Act (DORA) must have mandatory clauses. These include obligations for threat-based penetration testing, contingency plans, security measures, and maintaining a register of information on their ICT contracts.

Contracts with ICT service providers must include comprehensive monitoring and accessibility details, full-service level descriptions, and indications of locations where data is processed.

There are also specific requirements for contracts supporting critical functions, and these requirements need to be met by Q4 2024.

All contracts for ICT services, including Service Level Agreements, must be captured in "one written document" which must be available "on paper, or in a document with another downloadable, durable and accessible format".

Here’s a checklist of what you need when it comes to DORA-compliant contracts:

• A clear and complete description of the services
• Location of services performed
• Service level descriptions
• Detailed data protection provisions
• Appropriate termination rights include exit/transition management
• Minimum notice periods
• Provisions requiring full cooperation with the competent authorities
• Assistance (and cost) in the event of an ICT incident
• Vendor’s participation in the financial entities' security awareness programmes
• Vendor’s participation in the financial entities' digital operational resilience training

You’ll likely have some of these included, however, when it comes to provisions that require assistance, collaboration, and involvement in your operational resilience training, it’s unlikely you’ll have these in place with existing vendors.

For your existing vendors, you’ll need to triage the contracts that need attention, and you’ll need to understand which are the most important to focus on initially.

With Gatekeeper, we can triage these and place every vendor contract that needs an amendment into the Best Practice Workflow for Contract Amendments. This is a workflow that takes you minutes to set up via our guided configuration guide.

We’ll then update the trigger in this workflow to only trigger our high-priority DORA-relevant contracts, and this will pull every contract into the workflow.

Subcontracting under DORA

Regarding subcontracting, DORA only has basic rules. It says that the contract must state if subcontracting of an ICT service, that supports a key or important function, is allowed.

The contract should also mention the terms of subcontracting and the places where the subcontracted functions, ICT services, and data processing activities are happening.

The best practice will likely be to flow these DORA-specific clauses throughout your supply chain to enforce compliance beyond tier vendors.

Detailed Vendor Reporting of ICT Vendors for DORA

You’ll now have an incredible dataset that you can use to report on the compliance status across your vendor base when it comes to DORA. You can present reports to auditors and internal stakeholders.

Gatekeeper has built-in reporting, and via the vendor repository, we can create saved views that let us tailor reports depending on what we need.

From here, you’ll get a read on your existing vendors and contracts regarding their compliance levels. As you onboard new vendors and sign new contracts they’ll be pulled into the reporting so that you understand your DORA compliance levels at a glance.

Closing thoughts

DORA will stretch far and wide for any entity trading within the EU. Its coverage will be similar to GDPR and it mimics a move across the globe of increased focus on digital supply chains that have largely gone unregulated until now.

DORA compliance isn’t going to be possible with a spreadsheet. You need digital vendor and contract management to enable this.

If you’re considering your approach to DORA, book a call with one of our Vendor and Contract Management experts today to discuss your approach.