DORA requires a register of ICT third parties, how do I support that?

DORA obliges financial entities to maintain a live register of all ICT third-party providers, distinguishing critical from non-critical services. For SMB vendors that means tight data delivery to customers.

Try this first

1. 1Per service deliver at minimum: your entity data (name, KvK, LEI if available), service description, data and staff location, sub-providers and concentration with other vendors.
2. 2Mark whether your service is critical or important to the customer. The classification is theirs, but your input on outage impact helps.
3. 3Align contracts to DORA requirements: incident notification windows, audit rights, exit plan, data portability, sub-outsourcing rules. Many financial customers send DORA addenda.
4. 4Build a change process. Changing a sub-processor, hosting country or security baseline must reach the customer's register in time.
5. 5Test a DORA incident scenario with a major customer once. It exposes where reporting and channels fall short.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.