DORA and ICT third-party risk: what outside-in evidence can show
DORA makes financial entities fully responsible for the ICT providers they rely on. Outside-in evidence covers a small, concrete part of that duty: what each provider shows the internet.
By the TrustSek editorial team · Last reviewed
- Regulation
- (EU) 2022/2554
- Applies from
- 17 January 2025
- Articles
- 28 to 30
DORA makes ICT providers part of your own risk.
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025. It covers most of the financial sector: credit institutions, payment and electronic money institutions, investment firms, crypto-asset service providers, insurance and reinsurance undertakings, insurance intermediaries, occupational pension funds and more.
Chapter V deals with ICT third-party risk. Article 28(1) puts it plainly: financial entities manage ICT third-party risk as part of their ICT risk management framework, and they remain fully responsible for their obligations when they use an ICT provider. Outsourcing a service does not outsource the responsibility.
What Article 28 asks, and where outside-in evidence fits.
| What it asks | Outside-in evidence | |
|---|---|---|
| 28(1) | Manage ICT third-party risk within the ICT risk framework, and stay fully responsible | No: governance |
| 28(3) | Keep a register of information on every contractual arrangement for ICT services | No, but a dated result can be filed with the provider's entry |
| 28(4) | Before contracting, assess whether the service supports a critical or important function, identify the risks, including concentration risk, and carry out due diligence | Partly: the provider's public security is one input to due diligence |
| 28(5) | Only contract providers that comply with appropriate information security standards | Partly: shows whether the visible basics are in place, not whether a standard is met |
| 28(7) | Be able to terminate, among other grounds, for evidenced weaknesses in the provider's ICT risk management | Partly: dated findings can be part of that evidence, never all of it |
| 28(8) | Have exit strategies for services supporting critical or important functions | No |
Article 29 adds an assessment of ICT concentration risk, and Article 30 lists the key terms the contract must contain, from service locations and data access to incident assistance, audit rights and exit. Those are contract and governance work. Outside-in evidence does not replace any of it.
Use it in due diligence, before the contract.
Due diligence under Article 28(4) usually means questionnaires, certificates, audit reports and contract reviews. Outside-in evidence adds something none of those give: what the provider actually shows the internet today, read without asking the provider for anything.
- Score the provider's domains before the questionnaire goes out. It needs no access and no cooperation.
- Compare the answers with the evidence. A provider that says it enforces email authentication but publishes no DMARC policy has given you a specific question to ask.
- Ask about findings, not generic controls. “Your customer portal still accepts TLS 1.0” gets a concrete answer, a fix date or a correction.
- File the dated result with the assessment and the provider's entry in your register, so you can show what you knew when you decided.
- Check again during the contract, for example at renewal or when the provider's role changes, and compare against the earlier result.
What it cannot show.
- Anything inside the provider. Access control, backups, incident handling, staff vetting and the provider's own supplier chain do not show from the internet.
- Compliance with a standard. A clean result means nothing visible was found. It is not evidence of ISO 27001 or any other certification.
- Your contract and register duties. The register, concentration risk, contract terms and exit plans are yours to document. No external scan produces them.
- Ownership with certainty. Large providers run on shared cloud platforms. Check that each finding concerns an asset the provider actually operates.
The guide to security ratings explains what outside-in scores can and cannot tell you in general, and the methodology shows how TrustSek builds its score.
Questions
Does DORA require security ratings?
No. DORA does not name security ratings or any specific tool. It requires you to assess providers and their risks before and during the contract. Outside-in evidence is one way to make part of that assessment concrete and dated.
How does DORA relate to NIS2?
For financial entities in its scope, DORA is the sector-specific act. Its rules on ICT risk management and incident reporting apply instead of the equivalent NIS2 rules. The NIS2 page covers the overlap for organisations that fall under NIS2.
Does it work for providers outside the EU?
Yes. Public evidence looks the same wherever the provider is based, and no access to the provider's systems is needed.
Check an ICT provider's domain
Enter a provider's domain, or your own, and see the public evidence behind the score. The provider is not contacted.