DORA Register of Information & Third-Party Risk Programme
A Swedish fintech organization had 146 ICT third-party arrangements with 92 providers, spread across procurement, IT and business units, and no single view of which ones supported critical or important functions. With its first DORA register of information due to Finansinspektionen ahead of the April 2025 EU deadline, NCG built the register from source data, classified every provider and fixed the contracts that fell short of Article 30.
Client Overview
Challenges Faced By Client
DORA requires every in-scope firm to hold a register of all ICT third-party arrangements in a fixed EU template and to submit it to its supervisor. The organization had the contracts, but not the data the template asks for.
- Supplier data split across three systems with no shared supplier ID
- No mapping from ICT services to critical or important functions
- Subcontracting chains for key cloud and software providers unknown
- 15 of the 24 contracts supporting critical functions missing DORA Article 30 clauses on audit, exit or incident notification
- A fixed submission deadline with no room to slip
How NCG Helped
We treated the register as a data problem first and a compliance problem second.
Source data, not surveys
We pulled supplier, contract and spend data from procurement, finance and the CMDB, matched it on legal entity identifiers, and asked contract owners only to confirm what the data could not show.
Function mapping
Working with business owners, we defined 11 critical or important functions and linked each ICT service to the functions it supports, giving a traceable chain from function to service to provider.
Subcontractor tracing
For providers supporting critical functions, we requested and recorded material subcontractors, so the register reflected the real dependency chain.
Contract remediation
We compared critical contracts against Article 30, drafted a standard DORA addendum with legal, and ran negotiations with the highest-risk providers first.
Submission and ownership
We validated the register against the EU reporting rules, supported the first submission, and handed over a process so the register stays current without a project team.
Solutions Implemented By NCG
A register the supervisor accepted and a process that keeps it accurate.
- DORA register of information in the EU template
- Critical or important function inventory with service mapping
- Third-party risk classification method
- Standard DORA contract addendum
- Register maintenance process with named owners
