Third-Party Risk Management

Third-party risk management is a critical requirement under the Digital Operational Resilience Act (DORA), ensuring financial institutions and ICT providers identify, monitor, and mitigate risks associated with their external vendors.

Outlined in Articles 28–33, this requirement addresses the need for robust oversight of third-party ICT service providers to maintain operational resilience and compliance with regulatory standards.

This requirement complements the other core pillars of DORA:

• ICT Risk Management
• Incident Reporting
• Operational Resilience Testing
• Information Sharing

Together, these requirements provide a comprehensive framework for ensuring digital operational resilience across the financial sector. This guide focuses on the third-party risk management aspect, detailing practical steps, tools, and strategies to align with DORA’s expectations. 

📚 Related: The Digital Operational Resilience Act (DORA) - Regulation (EU) 2022/2554

What is Third-Party Risk Management under DORA?

Third-party risk management involves identifying, assessing, and mitigating risks that arise from dependencies on external service providers. For financial institutions, these providers can include cloud service providers, cybersecurity vendors, data hosting companies, and other ICT services integral to their operations.

Under DORA, third-party risks are explicitly regulated to ensure financial institutions remain resilient even when critical services are outsourced. 

📚 Related: Official DORA Journal of the EU

DORA Compliance Requirements for Third-Party Risk Management

DORA outlines clear requirements for third-party risk management to ensure financial institutions remain resilient even when outsourcing critical services. These include:

• Identifying and prioritizing critical third-party relationships.
• Conducting thorough risk assessments and maintaining updated vendor risk profiles.
• Embedding resilience and compliance obligations into vendor contracts.
• Monitoring vendor performance and ensuring continuous oversight.
• Including third-party providers in incident response plans and resilience testing.
• Documenting and reporting third-party risk management activities to regulators. 

📚 Related: DORA Maturity Assessment

Core Elements of Third-Party Risk Management under DORA

1. Identifying Critical Third-Party Relationships (Article 28)

The first step in third-party risk management is to identify vendors whose services are integral to the organization’s operations.

These critical relationships often include cloud providers, cybersecurity vendors, and payment processors. DORA mandates that organizations focus their risk management efforts on these high-impact third parties.

Organizations typically begin by mapping their vendor ecosystem to identify critical dependencies. Enterprise architecture tools help visualize how third-party services integrate into the broader ICT landscape, such as showing how a cloud provider supports a core banking platform.

Institutions assess vendors based on factors such as the volume of data processed, service criticality, and potential business impact of disruptions.

Key Activities:

• Map all third-party relationships using enterprise architecture tools like SAP LeanIX, visualizing their dependencies within the ICT landscape.
• Assess the criticality of each vendor based on factors such as service importance, data sensitivity, and potential operational impact.
• Regularly update vendor inventories to reflect changes in relationships or service scope.

The outcome is a comprehensive understanding of third-party relationships, enabling organizations to focus on the most critical risks.

2. Performing Third-Party Risk Assessments (Article 29)

Risk assessments evaluate a vendor’s ability to meet operational, security, and compliance requirements. These assessments identify vulnerabilities that could threaten the organization’s resilience.

Risk assessments often involve reviewing vendor security policies, incident response plans, and compliance certifications, such as ISO 27001 or SOC 2. Organizations also evaluate the vendor’s financial health, geographic location, and data protection measures.

For example, assessing a data hosting provider might include testing its backup protocols and reviewing its disaster recovery plans.

Key Activities:

• Review vendor security certifications (e.g., ISO 27001) and compliance documentation (e.g., SOC 2 reports).
• Conduct onsite or virtual audits to assess vendor infrastructure, processes, and controls.
• Simulate specific threat scenarios to evaluate a vendor’s resilience, such as testing their response to a simulated DDoS attack.
• Gather insights from cross-departmental stakeholders, including IT, compliance, and risk management teams.

The outcome is a detailed risk profile for each critical vendor, guiding decisions about collaboration and risk mitigation.

3. Contractual Risk Mitigation (Article 30)

DORA requires organizations to define clear resilience and compliance obligations in contracts with third-party providers. Contracts ensure vendors are accountable for their role in operational stability.

Organizations work with legal teams to draft contracts that align with DORA requirements. These contracts typically mandate regular security audits, compliance with international standards, and participation in resilience tests, such as Threat-Led Penetration Testing (TLPT).

For instance, a contract with a cloud provider might include SLAs specifying recovery time objectives (RTOs) during outages and penalties for non-compliance.

Key Activities:

• Draft detailed SLAs that define response times, recovery objectives, and penalties for non-compliance.
• Include clauses requiring vendors to participate in operational resilience testing, such as Threat-Led Penetration Testing (TLPT).
• Establish provisions for regular security audits and compliance reporting.
• Negotiate rights to terminate contracts if vendors fail to meet DORA requirements.

The outcome is legally enforceable agreements that hold vendors accountable for resilience and compliance.

4. Monitoring and Continuous Oversight (Article 31)

Continuous monitoring ensures vendors consistently meet the agreed-upon resilience and compliance standards. This ongoing process helps organizations identify and address emerging risks promptly.

Organizations leverage tools like SIEM platforms and governance dashboards to monitor third-party systems in real time. These tools provide visibility into performance metrics, such as uptime, response times, and security incidents. Regular audits and periodic reviews ensure that vendors remain compliant with regulatory requirements.

For example, a financial institution might conduct quarterly reviews of its payment processor’s incident response logs to verify adherence to agreed-upon protocols.

Key Activities:

• Use tools like SIEM platforms to track vendor system performance and detect anomalies in real time.
• Conduct periodic audits and reviews to validate vendor compliance with SLAs and regulatory requirements.
• Monitor industry developments and regulatory updates that may affect vendor operations.
• Establish dashboards to provide senior management with visibility into vendor performance and associated risks.

The outcome is a proactive risk management approach, ensuring third-party compliance and operational continuity.

5. Incident Response and Communication Protocols (Article 32)

DORA requires third-party providers to integrate with the organization’s incident response plans, ensuring coordinated efforts during disruptions.

Organizations establish joint incident response protocols with critical vendors, defining roles, responsibilities, and communication workflows. For example, a ransomware attack on a cloud provider hosting customer data would trigger coordinated efforts between the vendor and the institution to mitigate the breach and inform regulators. These protocols are tested regularly through simulations to ensure effectiveness.

Key Activities:

• Develop joint incident response plans with critical vendors, outlining roles, responsibilities, and communication workflows.
• Test response plans through simulations, ensuring vendors can handle real-world disruptions effectively.
• Define notification requirements for vendors to report incidents promptly, including escalation protocols for severe disruptions.

The outcome is a cohesive incident management strategy that incorporates third-party actions, minimizing the impact of vendor-related disruptions.

6. Reporting and Regulatory Compliance (Article 33)

Transparency and accountability are key to DORA compliance. Organizations must document their third-party risk management activities and provide detailed reports during regulatory audits.

Compliance teams maintain detailed records of vendor assessments, contracts, and performance audits. BPM tools streamline the reporting process, ensuring all required information is documented and readily available for regulatory reviews.

For instance, during a regulatory audit, an institution might provide evidence of how a vendor participated in resilience testing or met SLA targets.

Key Activities:

• Maintain a centralized repository of vendor assessments, contracts, and performance audits.
• Automate reporting processes using tools like SAP Signavio, ensuring compliance documentation is accurate and up to date.
• Provide regulators with evidence of vendor resilience testing and SLA adherence during audits.

The outcome is robust documentation that demonstrates compliance with DORA’s third-party risk management requirements. 

Third-Party Risk Management Tools and Technologies

• Enterprise Architecture Platforms (e.g., SAP LeanIX): Help organizations map vendor relationships and visualize dependencies within the ICT landscape.
• Governance Dashboards: Provide real-time monitoring of third-party performance metrics, such as uptime and SLA adherence.
• Risk Assessment Frameworks: Standardized frameworks like ISO 27005 enable consistent evaluations of vendor risks.
• Process Automation Tools (e.g., SAP Signavio): Streamline vendor assessments, contract management, and regulatory reporting.
• Threat Simulation Tools: Validate vendor resilience through simulations like TLPT, ensuring their ability to withstand disruptions. 

📚 Related: The Role of Enterprise Architecture in DORA Compliance

Most Common Challenges

1. Complex Vendor Ecosystems: Managing risks across a diverse and evolving vendor network can be overwhelming.
   Solution: Use enterprise architecture tools to centralize vendor information and visualize dependencies.
   
   
2. Vendor Resistance to Testing: Third parties may be reluctant to participate in resilience tests or audits. 
   Solution: Include mandatory testing clauses in contracts and engage vendors early in the testing process.
   
   
3. Resource Constraints: Smaller organizations may lack the resources to conduct comprehensive assessments and monitoring. 
   Solution: Prioritize critical vendors and leverage automation tools to streamline risk management processes.
   
   
4. Regulatory Ambiguity: Navigating overlapping regulatory requirements can be challenging. 
   Solution: Align third-party risk management efforts with frameworks like ISO 27001 to ensure broad compliance. 

Best Practices

• Establish Comprehensive Policies: Develop clear policies for third-party risk management, outlining procedures for vendor onboarding, assessment, and monitoring.
• Leverage Advanced Tools: Use platforms like SAP LeanIX to map dependencies and SIEM tools to monitor vendor performance in real time.
• Foster Collaboration: Work closely with vendors to build resilience, sharing insights and participating in joint training or simulations.
• Prioritize Critical Vendors: Focus resources on vendors whose services are essential to operations, ensuring their compliance and resilience efforts are robust.
• Regularly Update Risk Profiles: Continuously assess and update vendor risk profiles to reflect changes in their operations, services, or regulatory environment. 

Embedding these practices into long-term strategies, supported by robust tools and clear contractual obligations, helps institutions build secure, reliable partnerships that adapt to the changing digital landscape.