DORA · Art.28 · Register of Information · ICT TPP

DORA ICT Third-Party Provider Register of Information Builder

Build and validate the Register of Information on ICT third-party service provider contracts required by DORA Article 28. Validates against EBA/ESMA/EIOPA Joint ITS template. For all DORA-scoped EU financial entities.

DORA Jan 2025 Art.28 RoI ESAs Joint ITS Zero PII

🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.

Panel 01Entity & Register Scope
Panel 02Provider Entries (up to 4)

Enter details for up to 4 ICT third-party service providers. All critical/important providers must be fully documented in the Register of Information.

Panel 03Art.30 Contractual Provisions
DORA Register of Information
-
Register Summary
ProviderService CategoryCriticalityHQ JurisdictionExit StrategySubcontractingContract Type
Art.30 Gaps & Remediation
AP2 Policy Mandate · CC BY 4.0 · Post Oak Labs

Regulatory Citations

[1]Regulation (EU) 2022/2554 (DORA) Article 28: Register of Information on contractual arrangements with ICT third-party service providers. Financial entities must maintain a complete register and report to competent authorities upon request. Applicable from 17 January 2025.
[2]DORA Article 30: Key contractual provisions for ICT third-party service provider agreements. Critical/important services must include: service description, SLAs, data location, audit rights, incident notification, exit strategy, and business continuity obligations.
[3]ESAs Joint ITS on Register of Information JC 2023 84 (draft): Joint ITS from EBA, ESMA, and EIOPA specifying the standardised format and templates for the Register of Information to be submitted to NCAs. Based on DORA Art.28(9).
[4]EBA Single Rulebook Q&A on DORA third-party register requirements: clarifies scope, timing, and content obligations for the Register of Information, including treatment of intra-group ICT service arrangements.
[5]ESMA Guidelines on outsourcing to cloud service providers: sets out expectations for contractual provisions, exit strategies, and security requirements for cloud outsourcing arrangements relevant to DORA Art.30 compliance.

Regulatory citations in this tool are subject to the reliance notice.