DORA-Art28-P3

Article
28 (3)
Pillar
Third-Party ICT Risk Management
Regulation Ref
Regulation (EU) 2022/2554, Article 28(3)
Last Reviewed
2026-01-15

Financial entities shall, at entity level, and on a sub-consolidated and consolidated basis, maintain and update a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers.

Evidence Profiles

ICT Third-Party Service Provider Register COMMON

CSV register of all ICT third-party service providers with contractual arrangement details, service descriptions, criticality assessments, and data processing locations as required by DORA Article 28(3).

Formats
CSV JSON
Evidence Class
ict-provider-register
Availability
COMMON
Update Frequency
quarterly
Typical Author
Vendor Management Officer
Approval Chain
Vendor Management Officer → CRO

Content Sections

Expected Fields

Common Quality Issues

View Example

Generated example artifact using the default institution profile (COMMON availability, synthetic data only).

CSV — Inline Preview 
provider_id,provider_name,service_description,contract_start_date,contract_end_date,criticality_level,data_processing_locations,subcontractors,annual_cost_eur
PRV-001,Meridian Cloud Services GmbH,Core banking infrastructure hosting — IaaS platform providing compute and storage for Temenos T24 and Oracle Database environments,2021-03-01,2026-02-28,Critical,"Frankfurt DE, Dublin IE","Equinix (colocation), Cloudflare (CDN)",2450000
PRV-002,Sentinel Cyber AG,Managed Security Operations Centre — 24/7 SIEM monitoring and endpoint detection and response services,2022-06-15,2025-06-14,Critical,"Zurich CH, Vienna AT",CrowdStrike (EDR platform),890000
PRV-003,SwiftPay Solutions B.V.,Payment processing gateway — card acquiring and SEPA payment processing services,2020-01-01,2025-12-31,Critical,"Amsterdam NL, Frankfurt DE","Worldline (card network connectivity), AWS (secondary processing)",1750000
PRV-004,DataVault Storage Ltd,Offsite backup and disaster recovery — encrypted backup replication and DR site hosting,2023-01-15,2028-01-14,Critical,"Geneva CH, Luxembourg LU",None,620000
PRV-005,NordicSoft Oy,Regulatory reporting platform — automated regulatory return generation and submission for FINMA and ECB,2022-09-01,2025-08-31,Important,"Helsinki FI, Frankfurt DE",AWS (hosting),340000
PRV-006,CloudComm SaaS Ltd,Unified communications platform — email and collaboration services including Microsoft 365 and Teams,2021-07-01,2026-06-30,Important,"Dublin IE, Amsterdam NL",Microsoft (underlying platform),285000
PRV-007,ThreatIntel Partners GmbH,Cyber threat intelligence — threat feed aggregation and analysis for financial sector threats,2024-01-01,2026-12-31,Standard,"Berlin DE",None,95000
PRV-008,ComplianceDoc AG,Document management system — secure storage and workflow for compliance documentation,2023-04-01,2026-03-31,Standard,"Zurich CH",AWS (hosting),120000
PRV-009,AnalyticsPro S.A.,Business intelligence and data analytics — data warehouse and reporting platform,2022-11-01,2025-10-31,Important,"Luxembourg LU, Frankfurt DE","Snowflake (data platform), Tableau (visualisation)",410000
PRV-010,AuditTrail Systems Ltd,Identity and access management — privileged access management and single sign-on services,2023-08-01,2026-07-31,Critical,"London GB, Frankfurt DE",CyberArk (PAM platform),530000
PRV-011,NetGuard Telecom AG,Wide area network connectivity — MPLS and SD-WAN services connecting branch offices and data centres,2020-06-01,2025-05-31,Important,"Zurich CH, Bern CH",Swisscom (last-mile connectivity),375000
PRV-012,InsurTech Data Services GmbH,Anti-money laundering screening — transaction monitoring and sanctions screening services,2021-02-01,2026-01-31,Critical,"Munich DE, Frankfurt DE",NICE Actimize (screening engine),680000
PRV-013,PrintSecure B.V.,Secure printing and document distribution — customer statement printing and postal distribution,2022-03-15,2025-03-14,Standard,"Rotterdam NL",PostNL (postal distribution),85000
PRV-014,DevOps Tooling SaaS Inc,Software development platform — CI/CD pipeline and code repository hosting,2024-03-01,2027-02-28,Standard,"Dublin IE, Oregon US",GitHub (underlying platform),62000
PRV-015,BankingAPI Connect Ltd,Open banking API gateway — PSD2-compliant API management and third-party provider connectivity,2023-06-01,2026-05-31,Important,"London GB, Frankfurt DE","AWS (hosting), Kong (API gateway)",290000

Expected Structured Facts

Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).

ict_provider_register_status — fs-ict-provider-register 
{
  "factId": "b1c2d3e4-f5a6-7890-bcde-f12345678901",
  "evidenceId": "a0b1c2d3-e4f5-6789-0123-456789abcde0",
  "evidenceClassId": "ict-provider-register",
  "factType": "ict_provider_register_status",
  "data": {
    "register_date": "2025-01-15",
    "total_providers": 15,
    "critical_providers": 4,
    "providers_with_contracts": 15,
    "providers_with_criticality_assessment": 12,
    "data_locations_documented": true,
    "subcontractors_documented": true,
    "last_full_review_date": "2025-01-15"
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-01-16T10:00:00Z",
  "supersededBy": null
}
provider_criticality_assessment — fs-provider-criticality-assessment 
{
  "factId": "c2d3e4f5-a6b7-8901-cdef-123456789012",
  "evidenceId": "b1c2d3e4-f5a6-7890-1234-567890abcdef",
  "evidenceClassId": "provider-criticality-assessment",
  "factType": "provider_criticality_assessment",
  "data": {
    "provider_id": "PRV-001",
    "assessment_date": "2025-01-20",
    "criticality_level": "critical",
    "business_functions_supported_count": 4,
    "impact_if_unavailable": "severe",
    "substitutability_rating": "difficult_to_substitute",
    "data_sensitivity_level": "restricted"
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-01-21T09:30:00Z",
  "supersededBy": null
}

ICT Provider Criticality Assessment PARTIAL

JSON-structured assessment of ICT third-party service provider criticality, including impact analysis, dependency assessment, and criticality classification.

Formats
JSON
Evidence Class
provider-criticality-assessment
Availability
PARTIAL
Update Frequency
annual
Typical Author
Risk Manager
Approval Chain
Risk Manager → CRO

Content Sections

Expected Fields

Common Quality Issues

View Example

Generated example artifact using the default institution profile (COMMON availability, synthetic data only).

JSON — Inline Preview 
{
  "criticalityAssessment": {
    "assessmentId": "CA-2025-Q1-001",
    "institution": "Nordvik Bank AG",
    "assessmentDate": "2025-01-20",
    "assessedBy": "Elena Vasquez, Risk Manager",
    "methodology": "DORA Article 28(3) Criticality Assessment Framework v2.0",
    "nextReviewDate": "2026-01-20"
  },
  "providerAssessments": [
    {
      "providerId": "PRV-001",
      "providerName": "Meridian Cloud Services GmbH",
      "assessmentDate": "2025-01-20",
      "criticalityLevel": "critical",
      "businessFunctionsSupported": [
        "Core banking operations",
        "Payment processing",
        "Customer data storage",
        "Regulatory reporting"
      ],
      "businessFunctionsSupportedCount": 4,
      "impactIfUnavailable": "severe",
      "impactDescription": "Complete loss of core banking capability. All customer-facing services offline. Payment processing halted. Estimated financial impact exceeding EUR 5M per day.",
      "substitutabilityRating": "difficult_to_substitute",
      "substitutabilityJustification": "Deep integration with Temenos T24 core banking system. Migration would require 12-18 months and significant re-architecture. Limited alternative providers with equivalent financial-grade hosting capability in EU.",
      "dataSensitivityLevel": "restricted",
      "dataProcessingLocations": ["Frankfurt DE", "Dublin IE"],
      "subcontractorDependencies": ["Equinix (colocation)", "Cloudflare (CDN)"],
      "contractualArrangement": "5-year framework agreement with annual renewal option",
      "annualCostEur": 2450000
    },
    {
      "providerId": "PRV-002",
      "providerName": "Sentinel Cyber AG",
      "assessmentDate": "2025-01-20",
      "criticalityLevel": "critical",
      "businessFunctionsSupported": [
        "Security monitoring",
        "Incident detection and response",
        "Threat intelligence"
      ],
      "businessFunctionsSupportedCount": 3,
      "impactIfUnavailable": "significant",
      "impactDescription": "Loss of 24/7 security monitoring capability. Delayed incident detection increasing mean time to detect from minutes to hours. Regulatory non-compliance with DORA Article 10 detection requirements.",
      "substitutabilityRating": "substitutable_with_effort",
      "substitutabilityJustification": "Several managed SOC providers available in EU market. Transition would require 3-6 months for SIEM rule migration and tuning. Interim capability gap during transition.",
      "dataSensitivityLevel": "confidential",
      "dataProcessingLocations": ["Zurich CH", "Vienna AT"],
      "subcontractorDependencies": ["CrowdStrike (EDR platform)"],
      "contractualArrangement": "3-year contract with 12-month notice period",
      "annualCostEur": 890000
    },
    {
      "providerId": "PRV-003",
      "providerName": "SwiftPay Solutions B.V.",
      "assessmentDate": "2025-01-20",
      "criticalityLevel": "critical",
      "businessFunctionsSupported": [
        "Card payment processing",
        "SEPA credit transfers",
        "SEPA direct debits",
        "Instant payments"
      ],
      "businessFunctionsSupportedCount": 4,
      "impactIfUnavailable": "severe",
      "impactDescription": "All card and SEPA payment processing halted. Customer transactions blocked. Estimated revenue loss of EUR 800K per day. Reputational damage from service disruption.",
      "substitutabilityRating": "difficult_to_substitute",
      "substitutabilityJustification": "Payment processing requires PCI-DSS certification and direct card network connectivity. Limited providers with full SEPA and card acquiring capability. Migration estimated at 9-12 months.",
      "dataSensitivityLevel": "restricted",
      "dataProcessingLocations": ["Amsterdam NL", "Frankfurt DE"],
      "subcontractorDependencies": ["Worldline (card network connectivity)", "AWS (secondary processing)"],
      "contractualArrangement": "5-year agreement with performance-based pricing",
      "annualCostEur": 1750000
    },
    {
      "providerId": "PRV-010",
      "providerName": "AuditTrail Systems Ltd",
      "assessmentDate": "2025-01-20",
      "criticalityLevel": "critical",
      "businessFunctionsSupported": [
        "Privileged access management",
        "Single sign-on",
        "Identity governance"
      ],
      "businessFunctionsSupportedCount": 3,
      "impactIfUnavailable": "significant",
      "impactDescription": "Loss of privileged access controls. Emergency break-glass procedures required. Increased risk of unauthorised access. Regulatory non-compliance with access control requirements.",
      "substitutabilityRating": "substitutable_with_effort",
      "substitutabilityJustification": "Multiple PAM vendors available. Migration requires credential vault migration and policy reconfiguration. Estimated 4-6 months for full transition.",
      "dataSensitivityLevel": "restricted",
      "dataProcessingLocations": ["London GB", "Frankfurt DE"],
      "subcontractorDependencies": ["CyberArk (PAM platform)"],
      "contractualArrangement": "3-year contract with annual renewal",
      "annualCostEur": 530000
    },
    {
      "providerId": "PRV-005",
      "providerName": "NordicSoft Oy",
      "assessmentDate": "2025-01-20",
      "criticalityLevel": "medium",
      "businessFunctionsSupported": [
        "Regulatory reporting"
      ],
      "businessFunctionsSupportedCount": 1,
      "impactIfUnavailable": "moderate",
      "impactDescription": "Regulatory returns would require manual preparation. Risk of missed reporting deadlines. Increased operational burden on compliance team.",
      "substitutabilityRating": "substitutable_with_effort",
      "substitutabilityJustification": "Several regulatory reporting platforms available for Swiss and EU reporting. Migration estimated at 3-4 months including report template reconfiguration.",
      "dataSensitivityLevel": "confidential",
      "dataProcessingLocations": ["Helsinki FI", "Frankfurt DE"],
      "subcontractorDependencies": ["AWS (hosting)"],
      "contractualArrangement": "3-year contract",
      "annualCostEur": 340000
    }
  ]
}

Expected Structured Facts

Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).

ict_provider_register_status — fs-ict-provider-register 
{
  "factId": "b1c2d3e4-f5a6-7890-bcde-f12345678901",
  "evidenceId": "a0b1c2d3-e4f5-6789-0123-456789abcde0",
  "evidenceClassId": "ict-provider-register",
  "factType": "ict_provider_register_status",
  "data": {
    "register_date": "2025-01-15",
    "total_providers": 15,
    "critical_providers": 4,
    "providers_with_contracts": 15,
    "providers_with_criticality_assessment": 12,
    "data_locations_documented": true,
    "subcontractors_documented": true,
    "last_full_review_date": "2025-01-15"
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-01-16T10:00:00Z",
  "supersededBy": null
}
provider_criticality_assessment — fs-provider-criticality-assessment 
{
  "factId": "c2d3e4f5-a6b7-8901-cdef-123456789012",
  "evidenceId": "b1c2d3e4-f5a6-7890-1234-567890abcdef",
  "evidenceClassId": "provider-criticality-assessment",
  "factType": "provider_criticality_assessment",
  "data": {
    "provider_id": "PRV-001",
    "assessment_date": "2025-01-20",
    "criticality_level": "critical",
    "business_functions_supported_count": 4,
    "impact_if_unavailable": "severe",
    "substitutability_rating": "difficult_to_substitute",
    "data_sensitivity_level": "restricted"
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-01-21T09:30:00Z",
  "supersededBy": null
}

Fact Schemas

ict_provider_register_status

Schema ID
fs-ict-provider-register
Control
DORA-Art28-P3

Valid Ranges

register_date
within last 3 months
providers_with_contracts
should equal total_providers for full compliance
providers_with_criticality_assessment
should equal total_providers

Related Schemas

JSON Schema

{
  "properties": {
    "critical_providers": {
      "minimum": 0,
      "type": "integer"
    },
    "data_locations_documented": {
      "type": "boolean"
    },
    "last_full_review_date": {
      "format": "date",
      "type": "string"
    },
    "providers_with_contracts": {
      "minimum": 0,
      "type": "integer"
    },
    "providers_with_criticality_assessment": {
      "minimum": 0,
      "type": "integer"
    },
    "register_date": {
      "format": "date",
      "type": "string"
    },
    "subcontractors_documented": {
      "type": "boolean"
    },
    "total_providers": {
      "minimum": 0,
      "type": "integer"
    }
  },
  "required": [
    "register_date",
    "total_providers",
    "critical_providers",
    "providers_with_contracts"
  ],
  "type": "object"
}

provider_criticality_assessment

Schema ID
fs-provider-criticality-assessment
Control
DORA-Art28-P3

Valid Ranges

assessment_date
within last 12 months
criticality_level
critical if supporting critical business functions

Related Schemas

JSON Schema

{
  "properties": {
    "assessment_date": {
      "format": "date",
      "type": "string"
    },
    "business_functions_supported_count": {
      "minimum": 0,
      "type": "integer"
    },
    "criticality_level": {
      "enum": [
        "low",
        "medium",
        "high",
        "critical"
      ],
      "type": "string"
    },
    "data_sensitivity_level": {
      "enum": [
        "public",
        "internal",
        "confidential",
        "restricted"
      ],
      "type": "string"
    },
    "impact_if_unavailable": {
      "enum": [
        "negligible",
        "moderate",
        "significant",
        "severe"
      ],
      "type": "string"
    },
    "provider_id": {
      "minLength": 1,
      "type": "string"
    },
    "substitutability_rating": {
      "enum": [
        "easily_substitutable",
        "substitutable_with_effort",
        "difficult_to_substitute",
        "not_substitutable"
      ],
      "type": "string"
    }
  },
  "required": [
    "provider_id",
    "assessment_date",
    "criticality_level",
    "business_functions_supported_count"
  ],
  "type": "object"
}