Free resource · 9 areas

The DORA Article 30 checklist for ICT vendors

DORA has applied since 17 January 2025, and every EU bank, insurer and fintech must assess the ICT providers it uses before signing and monitor them afterwards. The questionnaire lands on your desk whether or not you knew the rule existed. These are the nine areas it covers, what to prepare for each, and which evidence closes the answer. Where an obligation only applies to services supporting a critical or important function, it says so.

Reg. (EU) 2022/2554 Art. 28–30 · RTS 2024/1773 · RTS 2025/532 · ITS 2024/2956 · operational checklist, not legal advice

Your readiness0/9 · 0%

The services a customer actually consumes

“Describe the services provided, their type, duration and the contracting entity.”

Prepare

→ One row per product or service a financial customer uses
→ Which contract covers it, and which support tier applies
→ The legal entity that signs — not the brand name on the site

Attach

✓ Signed order form or MSA
✓ One-page service description in plain language

Where data is processed and stored

“List every location where customer data is processed, stored or backed up.”

Prepare

→ Cloud regions in use, per environment
→ Backup and replica locations, including disaster-recovery sites
→ Any support access that originates from another country

Attach

✓ Architecture diagram with data flows
✓ Region list with a reason for each location

Access rights, data return and deletion

“What can you access, under what controls, and how does data leave at the end?”

Prepare

→ Roles that can read customer data, and how access is granted and revoked
→ Export format and the time it realistically takes
→ What is deleted, when, and who confirms it

Attach

✓ Data export procedure with a measured duration
✓ Deletion attestation template you can sign

Service levels that survive an audit

“What is committed, how it is measured, and how it is reported back.”

Prepare

→ Uptime figure, measurement window and what is excluded
→ How a customer is told the number was missed
→ Whether the commitment is contractual or best-effort

Attach

✓ SLA text as signed
✓ Uptime report for the last 12 months
✓ Public status page history, if you run one

Incident notification and support

“How fast you tell us, what you send us, and how escalation works.”

Prepare

→ Severity classes with a one-line definition each
→ Notification window for each class, in hours
→ Named escalation contact and out-of-hours route
→ Under Art. 19 the financial entity reports major incidents to its authority — never you. Your job is to hand it the facts in time: what happened, which services, root cause, remediation status. Say that explicitly instead of leaving the question open

Attach

✓ Incident response one-pager
✓ Customer notification template with the fields a supervisory report needs
✓ Most recent post-mortem, redacted

Audit rights and authority access

“Who may audit you, how often, on what notice, and what they may request.”

Prepare

→ Your position on on-site audits versus document review
→ Audit frequency you will accept without charging for it
→ The clause that lets the customer's competent authorities access your services

Attach

✓ Audit policy and prior audit responses
✓ ISO 27001 or SOC 2 scope statement, or an honest gap note

Your own subcontractors

“Which ICT providers sit underneath you, and which of them touch our data.”

Prepare

→ Every ICT subcontractor, its role and its country
→ Which ones process customer data or keep it available
→ The concentration risk: one provider whose failure breaks your service
→ How you approve changes and how the customer is told

Attach

✓ Subcontractor register, updated this quarter
✓ Concentration note in two sentences

Register of information: the data they need from you

“The fields our compliance team must file about you.”

Prepare

→ The register is the financial entity's obligation under Art. 28(3), filed with its national authority on the ITS templates (Reg. (EU) 2024/2956, forms B_01 to B_07). You do not fill it in — you supply the data
→ Your identification: legal name, LEI where you hold one, country of registration, corporate group if any
→ The service: ITS service-type code, contract dates, whether it supports a critical or important function, countries of provision and of data storage
→ Your subcontractors in the chain behind that service, in the same identifying detail
→ Keep one maintained sheet you send to every customer, not a per-customer fork

Attach

✓ A single spreadsheet your team maintains, aligned to the ITS field names
✓ Legal entity identifiers for you and for the subcontractors that have one

Continuity and a runnable exit

“How fast you recover, when you last proved it, and how we leave.”

Prepare

→ Recovery time and recovery point objectives, per service
→ Date and result of the last continuity test
→ An exit plan the customer could actually run without you

Attach

✓ Continuity plan summary
✓ Last disaster-recovery test report
✓ Exit checklist with owners

Where vendors lose time

Three gaps behind almost every slow answer

REWRITTEN

Answers rebuilt per customer

Every institution sends its own format, so the same security answer gets written again from scratch.

UNINDEXED

Evidence nobody can find

The certificate exists, in someone's inbox. Two weeks of asking is what the questionnaire actually costs.

UNMAPPED

A subcontractor chain nobody drew

Examiners ask about the provider behind your provider. Small vendors rarely have that list written down.

Next step

Turn this checklist into answers you reuse

The DORA Vendor Toolkit is the pre-written answer library, register template and evidence index behind these nine areas. Join the list for launch and founding-member pricing — no charge today.

VendorDORA is documentation work by PHABDEV, written from the regulation and its technical standards. It prepares your answers and evidence; your legal counsel reviews the contractual commitments.