DORA · the supply chain
Applies DORA to the financial entity and can inspect its suppliers through the contract.
Bank, insurer, payment firm, asset manager. Answerable for every ICT service it relies on.
Not in scope of DORA. Bound by whatever the contract with your customer says.
Recorded in your customer's register where they support a critical or important function.
Risk management, testing, continuity.
Four hours from classifying a major incident.
Every ICT contract, filed once a year.
Service, data locations, exit, termination.
For them, their auditor and their regulator.
Fast enough to keep them inside their clock.
Stated in your contract up front.
Your customer can object to a material change.
For what your subcontractors deliver.