Policy Briefing — September 9, 2025

Executive briefing: The Digital Operational Resilience Act (DORA) has applied since 17 January 2025. Article 28 now requires banks, insurers, and other financial entities to maintain a comprehensive register of all ICT third-party service providers, capturing services consumed, data classifications, geographic locations, and subcontracting arrangements. Supervisory authorities are requesting evidence of criticality assessments, contractual minimums, and documented exit plans as they prepare thematic reviews for late 2025.

Key governance checkpoints

• Inventory completeness. Reconcile procurement, security, and architecture records to ensure every ICT dependency appears in the DORA register, including shadow IT and intra-group shared services.
• Criticality scoring. Apply Article 28(3) criteria to classify services as critical or important, linking each to resilience requirements, testing cadences, and incident thresholds.
• Contract validation. Confirm agreements incorporate mandatory clauses on availability, integrity, confidentiality, location of data, and unrestricted access for competent authorities.

Operational priorities

• Exit strategy rehearsal. Produce scenario-based exit and transition plans for critical providers, including timelines, resource estimates, and fallback tooling.
• Incident integration. Ensure third-party incident reporting flows into DORA Article 19 incident classification and notification processes within the mandated timelines.
• Board reporting. Prepare quarterly dashboards for management bodies summarizing concentration risk, remediation progress, and upcoming supervisory requests.

Enablement moves

• Align the DORA register taxonomy with existing supplier risk tools to avoid double maintenance.
• Conduct tabletop exercises with procurement, legal, and technology risk teams to validate end-to-end response when a critical provider fails.

Sources

• Regulation (EU) 2022/2554 (DORA)
• Joint ESA guidelines on ICT third-party risk
• ECB supervisory expectations on DORA readiness

Zeph Tech readies financial institutions for DORA supervisory reviews by industrializing ICT third-party registers, criticality scoring, and exit strategy playbooks.

Related briefings

Curated signals from the same pillar or overlapping topics.

Policy · Credibility 40/100 · January 16, 2023

Policy Briefing — Digital Operational Resilience Act enters into force

On 16 January 2023 the EU’s Digital Operational Resilience Act (DORA) took effect, starting a phased timeline for financial entities and critical ICT providers to meet governance, testing, and third-party risk…

Policy · Credibility 92/100 · May 10, 2022

Policy Briefing — EU DORA Provisional Agreement

EU lawmakers reached a provisional agreement on DORA in May 2022, setting harmonised ICT risk, incident reporting, testing, and third-party oversight rules for financial institutions and critical ICT providers ahead of…

Policy · Credibility 50/100 · September 8, 2025

Policy Briefing — September 8, 2025

Eight months into the Digital Operational Resilience Act, EU supervisors are demanding Article 28 ICT third-party registers and harmonised incident evidence ahead of Q4 2025 reviews.

Policy · Credibility 93/100 · July 1, 2025

Policy Briefing — APRA CPS 230 go-live demands board-owned operational resilience evidence

CPS 230’s 1 July 2025 start requires boards to evidence operational risk governance, third-party resilience, and reporting routines that stand up to APRA assurance testing and year-one attestation.

Policy · Credibility 92/100 · March 31, 2021

Policy Briefing — Basel Principles for Operational Resilience

The Basel Committee issued principles for operational resilience and updated operational risk management standards, directing banks to map critical operations, test severe scenarios, and tighten third-party oversight…

Continue in the Policy pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

• Semiconductor Industrial Strategy Policy Guide — Zeph Tech

  Coordinate CHIPS and Science Act, EU Chips Act, and Defense Production Act programmes with capital planning, compliance, and supplier readiness.

• Digital Markets Compliance Guide — Zeph Tech

  Implement EU Digital Markets Act, EU Digital Services Act, UK Digital Markets, Competition and Consumers Act, and U.S. Sherman Act requirements with cross-functional operating…

• Export Controls and Sanctions Policy Guide — Zeph Tech

  Integrate U.S. Export Control Reform Act, International Emergency Economic Powers Act, and EU Dual-Use Regulation requirements into trade compliance, engineering, and supplier…