Regulation (EU) 2022/2554
The DORA register of information, up to date all year
Your supervisor asks for the register of information and you don’t know how many ICT providers support critical or important functions. Almenara keeps it with the same data you use to manage your providers, ready for your lead to review and submit.
Who it applies to
DORA has applied since 17 January 2025 to EU financial entities —credit institutions, investment firms, payment and e-money institutions, insurers and others— and reaches their ICT service providers through their contracts.
- Financial entities supervised by the Bank of Spain, the CNMV or the DGSFP
- ICT providers serving financial entities
- Technology risk and compliance teams in the sector
If this sounds familiar
The supervisor asks for your register of information and you don’t know how many critical ICT providers you have.
The register of information maintained all year, ICT provider assessment and on-time incident reporting.
What DORA requires
The regulation is organised into five pillars. These are the ones that generate the most operational work:
- Art. 5–16ICT risk management framework
- Identify, protect, detect, respond and recover, with a documented framework for which the management body is accountable.
- Art. 28.3Register of information
- A register of all contractual arrangements with ICT third-party service providers, which the competent authority may request.
- Art. 28–30ICT third-party risk
- Assess providers before contracting and throughout the relationship, with particular attention to those supporting critical or important functions.
- Art. 28.8Exit strategies
- Exit plans for ICT services supporting critical or important functions.
- Art. 17–19Major incidents
- Classify ICT-related incidents and report major ones with an initial, an intermediate and a final report.
- Art. 24–27Resilience testing
- A digital operational resilience testing programme proportionate to size and risk profile.
Platform · modules
How Almenara helps with DORA
The modules that save you the most work, in order.
- Third partiesICT provider inventory, functions supported, criticality and a register of information ready to submit.
- IncidentsClassification of ICT-related incidents and reporting deadlines for major incidents.
- ComplianceICT risk management framework, controls and review by the management body.
- ContinuityResponse and recovery, backups and exit plans linked to the BIA.
Framework catalogue
What you prove for DORA counts for the next framework
Every DORA requirement is mapped to Almenara’s common controls, like the rest of the catalogue. When you are asked for another framework or a customer’s questionnaire, you start from what you have already proven.
Service · where to start
DORA register of information, ready to submit
We gather the data on your arrangements with ICT providers, prepare the register in the format the authority requires and leave it ready for you to submit in the annual submission. After that, the Third parties module keeps it up to date.
Request the DORA registerRecommended services
- Service · Every year
We prepare the register of information on your arrangements with ICT providers, leave it ready for you to submit to your supervisor and update it every year.
- Service · Every year
A full incident response exercise, with the notification to the authority prepared as if it were real.
- Service · Per supplier
We design how to leave a critical supplier without stopping the processes that depend on it.
Our boundary: Almenara does not issue certificates (accredited certification bodies do) and does not carry out the internal audit of a system it has implemented or manages.
DORA FAQ
- What is the DORA register of information?
- It is the register required by Article 28(3) covering all contractual arrangements on ICT services provided by third parties. It is submitted to the competent authority using the templates set by EU technical standards.
- What is a critical ICT provider under DORA?
- Informally, the term is used for a provider supporting the entity’s critical or important functions. DORA reserves “critical ICT third-party service provider” for those designated by the European Supervisory Authorities, which fall under their direct oversight.
- What are the deadlines for reporting a major incident?
- DORA and its technical standards set an initial, an intermediate and a final report with specific deadlines from the moment the incident is classified as major. The incidents module keeps the countdown for each one.
- Do you help with exit plans?
- Yes. The exit plan for a critical provider can be contracted as a service, provider by provider.
Shall we prepare for DORA together?
We’ll show you what your system would look like in Almenara, with your own data.