DORA
The register of information, kept as the work happens.
Eurus keeps DORA's register of information from the providers, contracts, functions and exit plans a business records in it, in the columns of the Commission's templates. What is missing is named with its column, and the export is one file for each template.
What DORA asks
Article 28(3) of DORA, Regulation (EU) 2022/2554, asks each financial entity in its scope to keep a register of information on all its contractual arrangements for ICT services from third-party providers: at entity level and, in a group, at sub-consolidated and consolidated level.
Every arrangement
The register covers every contract for ICT services, including those behind functions that are neither critical nor important, and is kept up to date.
A yearly report
At least once a year the entity reports to its competent authority the number of new arrangements, the categories of provider, the types of arrangement, and the services and functions provided. For the firms it supervises, that is the Central Bank of Ireland.
The whole register on request
The full register goes to the competent authority when it asks for it.
Notice before a critical contract
A planned arrangement for ICT services that support a critical or important function, or a function that has become one, is told to the competent authority in good time.
The Commission's templates
Commission Implementing Regulation (EU) 2024/2956 sets the register's standard templates and their column codes, from the entity and its contracts to the functions they support.
How Eurus keeps it
The register is built from what the business records about its ICT providers, field by field, under the templates' own codes.
Providers and contracts
Each provider's identity, contract, locations and data, and the assessment of its service (templates B_05.01, B_02.01, B_02.02 and B_07.01).
Functions
The business's functions, whether each is critical or important and why, its recovery objectives, and the providers behind it (B_06.01).
Article 30's contract terms
For each provider, the provisions Article 30(2) asks of every contract, and those Article 30(3) adds where a critical or important function rests on it.
Exit plans
An exit plan for each provider behind a critical or important function, as Article 28(8) asks.
What is missing, by column
An empty cell stays empty and is listed with its column. The gaps are a list to work through.
Legal Entity Identifiers
An LEI is checked against the check digits of ISO 17442 when it is entered.
Concentration
What rests on each provider and group of providers, the single points of failure, and what each critical function depends on.
The export
Two downloads. The report package the Central Bank of Ireland collects: xBRL-CSV against the EBA's DORA taxonomy, every list in the EBA's own codes, checked against the taxonomy by Arelle, the open-source XBRL validator, in the tests each release passes. And the register's content as one CSV a template, to read. What the register does not hold, starting with the business's own LEI, is listed and left out, never filled in.
Try this in a copy of your own, for two hours, with nothing to sign up for.
Open your own copyDORA's other duties
Whether DORA applies is read from Article 2(1)'s entity types, Article 2(3)'s exclusions and Article 16's simplified framework. A major ICT incident's first notification is due within 4 hours of classifying it, and never later than 24 hours after becoming aware of it.
Want it on your own systems?
We start with an audit: how your operations really run, mapped to the controls you keep.