DORA: know your ICT providers, with the documents to prove it.
Since January 2025, DORA has required the financial sector to manage its ICT risk, including the risk that comes from its providers. Much of the work consists of gathering information, keeping it up to date, and proving it.
- Text
- Regulation (EU) 2022/2554, the Digital Operational Resilience Act
- Applicable since
- January 17, 2025
- Authorities in France
- ACPR (the French prudential supervisor for banking and insurance) and AMF (the French financial markets authority), depending on the entity
- Critical providers
- Overseen directly by the European supervisory authorities
01Who is concerned
Financial entities, and their ICT service providers.
The regulation lists about twenty categories of financial entities. ICT third-party service providers come within its scope through the contracts that bind them to those entities.
Banking and payments
Credit institutions, payment institutions and electronic money institutions, crypto-asset service providers.
Markets and asset management
Investment firms, management companies, alternative investment fund managers, trading venues, central securities depositories, central counterparties.
Insurance
Insurance and reinsurance undertakings, insurance and reinsurance intermediaries, institutions for occupational retirement provision, subject to size conditions.
ICT service providers
They must accept the contractual clauses set out in the regulation; the most critical ones are overseen at EU level.
02What the text requires
The five pillars of the regulation.
Management is accountable, and every pillar has to be documented.
ICT risk management
A risk management framework approved and overseen by the management body, with business continuity and response plans.
Articles 5 to 16ICT-related incidents
Classify incidents, and report major incidents to the competent authority within the set deadlines.
Articles 17 to 23Resilience testing
A testing program, and for certain entities, threat-led penetration testing.
Articles 24 to 27ICT third-party risk
A register of information on all ICT service contracts, an assessment before contracting, mandatory clauses, and exit strategies.
Articles 28 to 30Information sharing
Voluntary exchanges of information on threats between financial entities.
Article 45
03Your document exchanges
Where your document exchanges come in.
The register of information and the assessment of providers rely on documents you have to obtain, check, and keep up to date.
- Obtaining each provider's certifications, security policies, continuity plans, and subcontractors.
- Chasing the ones who have not answered, then starting again the following year.
- Finding the latest version of each document during an inspection.
- Sharing sensitive information with a provider without exposing it as an attachment.
04What Nestor brings
What Nestor brings.
Nestor helps you meet certain requirements: traceability, access control, hosting in France. Compliance remains your organization's responsibility.
- Your need
Gather information from your providers
A campaign asks each provider for the same documents and answers, in their own space, with reminders that stop once they have answered.
Learn more - Your need
Track who has answered
The campaign dashboard: opens, answers, documents to validate, provider by provider.
Learn more - Your need
Find the right version
Each document in the folder set aside for it, with its version history.
Learn more - Your need
Keep a trail
The activity log of each campaign, exportable as CSV.
Learn more - Your need
Assess Nestor, your provider
Nestor is pursuing ISO/IEC 27001:2022 certification; the documents of this process are available on request.
Learn more - Your need
Keep going during a crisis
Coming soonComing soon: the Safe Room, a crisis space you can reach from a browser when your usual tools stop responding.
Learn more
05Frequently asked questions
Frequently asked questions
Does Nestor make me DORA compliant?
No. DORA covers your entire digital resilience. Nestor helps you gather and update information from your providers, and keep a trail of your exchanges. Compliance remains your organization's responsibility.
Does DORA concern providers like Nestor?
Yes, through contracts. A financial entity must assess its ICT providers and include the clauses set out in the regulation in its contracts. We send the documents of our ISO/IEC 27001 process on request.
What about NIS 2 for a bank?
For financial entities, DORA takes precedence over NIS 2 for ICT risk management and incident reporting.
Sources and related pages
These pages are for information only and do not replace legal advice.
A register of providers to keep up to date?
Tell us how many providers you track and what you ask them for, and we will show you the matching campaign.
- Fully sovereign European hosting
- No account to create for the people you work with