DORA ICT third-party questionnaire: what suppliers get asked
Published · Qlara
The Digital Operational Resilience Act, Regulation (EU) 2022/2554 or DORA, has applied since 17 January 2025. Its obligations fall on financial entities such as banks, insurers, and investment firms. Those entities must manage the risk of the ICT services they buy, so they pass many of the requirements on to suppliers through due diligence questionnaires and contract clauses. If you sell software or ICT services to a financial customer in the EU, this guide explains which questions come from which article, and how to answer them without promising more than your contract and evidence support.
Why a financial customer sends you these questions
Article 28(1) says that a financial entity using ICT services remains fully responsible for complying with DORA and financial services law. Outsourcing does not move that responsibility to the supplier. That is why the questionnaire can feel detailed: the customer needs evidence it can show its own supervisor.
Article 28(4) lists what the entity must do before signing: assess whether your service supports a critical or important function, identify and assess the risks, including concentration risk, do due diligence on whether you are suitable, and assess conflicts of interest. Article 28(5) adds that entities may only contract with suppliers that comply with appropriate information security standards. Article 28(3) requires the entity to keep a register of information on all its ICT contracts, so expect questions that simply collect facts for that register: legal entity, service description, locations, and subcontractors.
The articles are written for the financial entity, not for you. Unless your company is designated as a critical ICT third-party service provider under DORA's separate oversight framework, your obligations arise from the contract you sign with the customer. Answer the questionnaire factually, and let the contract carry the commitments.
Questions that follow from Article 30(2): every ICT contract
Article 30(2) lists the minimum content of any contract for ICT services. Buyers often turn each element into a questionnaire row so they can check your standard terms before negotiating. In plain terms, expect to be asked about:
- A complete description of the services, and whether subcontracting of a critical or important function is allowed and on what conditions (point a).
- The regions or countries where the service is provided and data is processed and stored, and whether you will notify the customer in advance of a change (point b).
- How you protect the availability, authenticity, integrity, and confidentiality of data, including personal data (point c).
- How the customer gets access to, recovers, and receives its data in an easily accessible format if you become insolvent, stop operating, or the contract ends (point d).
- Service level descriptions and how they are updated (point e).
- Whether you assist with ICT incidents related to your service at no additional cost or at a cost agreed in advance (point f).
- Your obligation to cooperate fully with the customer's competent and resolution authorities (point g).
- Termination rights and minimum notice periods (point h).
- Whether you take part in the customer's ICT security awareness and digital operational resilience training (point i).
Extra questions if you support a critical or important function
Article 30(3) adds requirements when your service supports a critical or important function of the financial entity. The questionnaire usually asks first whether this applies, because the customer must make that assessment under Article 28(4)(a). If it does, expect questions about precise quantitative and qualitative service level targets, notice of developments that could affect your ability to deliver, business contingency plans that you implement and test, participation in the customer's threat-led penetration testing (TLPT), unrestricted rights of access, inspection, and audit for the customer and its competent authority, and an exit strategy with a mandatory transition period.
Article 29 explains another group of questions. Before signing, the entity must consider concentration risk: whether you are easy to substitute, and whether it already relies on you or closely connected providers. Where subcontracting of a critical or important function is possible, it must weigh the risks of long subcontracting chains and of subcontractors in third countries. So expect a full subprocessor list with locations, and questions about who could replace you.
Worked example 1: data location and change notice
The examples below are written by Qlara for illustration. The supplier and its documents are fictional.
- Buyer question
- In which countries will our data be processed and stored, including by subcontractors? Will you notify us before changing these locations?
- Answer
- Customer data is stored and processed in Germany (Frankfurt) by our hosting and database providers, and AI processing takes place in France. The full subprocessor list with locations is in Annex 2 of our DPA. We notify customers 30 days before adding a subprocessor or changing a processing location, as set out in DPA section 7.
- Evidence
- Hosting and Data Residency Statement; DPA Annex 2 (subprocessors); DPA section 7 (changes).
- What a reviewer checks
- That every subprocessor in the answer matches the current DPA annex, and that the notice period matches the signed terms, not an older draft.
Worked example 2: exit and return of data
Exit questions combine Article 30(2)(d) on data return with Article 30(3)(f) on transition periods. Separate what the product can do today from what needs a contract clause.
- Buyer question
- How will you return our data on termination or insolvency, in what format, and will you support a transition period?
- Answer
- Customers can export all their content at any time from Settings as JSON and Excel files. On termination, customer content is deleted within 30 days unless the customer asks for a copy first. A transition period with continued service is not part of the standard terms and can be agreed in the contract.
- Evidence
- Product documentation for data export; Terms section 12; Privacy Policy retention section.
- What a reviewer checks
- That the export formats exist in the product today and that the answer does not promise a transition period the standard contract does not include.
Worked example 3: a commitment that belongs to the contract
Some rows ask for a promise rather than a fact, for example participating in the customer's TLPT under Article 30(3)(d) or giving unrestricted audit rights under Article 30(3)(e). If your sources do not cover it, do not write Yes to keep the file tidy. Leave the row open and route it to whoever negotiates contracts.
- Buyer question
- Will you participate and cooperate fully in our threat-led penetration testing?
- Draft status
- GAP: no approved source covers TLPT participation.
- Answer after legal review
- We will cooperate with TLPT that covers our service on terms agreed in the contract, including scope, timing, and confidentiality. Our standard terms do not yet include a TLPT clause.
Keep the questionnaire and the contract consistent
Article 30(1) requires the full contract, including service levels, to be in one written document. Your questionnaire answers will often be compared with that document. If an answer says 30 days' notice and the contract says 14, the customer has to resolve the conflict and may ask why. Answer from the current signed or standard terms, cite the clause, and send anything new to legal review instead of improvising it in a spreadsheet cell.
- Ask the customer whether they classify your service as supporting a critical or important function.
- Prepare the facts once: legal entity, services, locations, subprocessors, service levels, incident support, exit and data return.
- Cite the DPA, terms, or policy clause for every contractual answer.
- Flag requests that need a new commitment and route them to the contract owner.
- Keep the final answers with the contract version they were based on.
Where Qlara fits
Qlara includes a DORA ICT third-party risk question pack and can import the customer's own workbook. It drafts answers from your approved policies, DPA, and terms with citations, and flags a row as GAP when no source supports it, which is what you want for contractual commitments you have not made. Every answer is reviewed by a person before export. Qlara is not legal advice and does not decide whether your service supports a critical or important function.
Sources
- EUR-Lex: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Articles 28, 29, 30 and 64. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2554 (accessed )
This guide is general information, not legal advice. Check the current version of the source before relying on it.