Advanced · Self-paced learning
Managing ICT Third-Party Risk
Assess an ICT supplier and decide what evidence your organisation needs for the service, who checks it and what happens if it is missing.
Read the descriptionAdvanced · Self-paced learning
DORA Third-Party Risk and Exit Planning
Inquiry This course is not yet bookable.
Work with the case or a service in your EU financial entity. Record providers, subcontractors and shared dependencies. Compare contract extension, transitional operation and replacement capacity, check the evidence needed and calculate the sequence. Revise your plan if export and replacement capacity become available sooner.
Take away a completed third-party register and exit work plan covering data export, replacement capacity and transition steps. Contract questions and DORA obligations require specialist and legal review for your situation.
What you will work on
- You produce a third-party and concentration register for one defined service that distinguishes providers, subcontractors, criticality and evidence status.
- You assess contract control and exit readiness against selected evidence and make assumptions and gaps explicit.
- You compare the notice period with data export and replacement capacity lead times.
Who it is for
- Outsourcing and third-party management
- Procurement and contract management
- Service owners responsible for critical ICT services
Topics
- Locating the task within the DORA context and defining the decision mandate
- Providers, subcontractors and dimensions of concentration
- Criticality, substitutability and service dependencies
- Contract control, evidence and unresolved legal questions
- Exit triggers, minimum service and transition planning
- Management brief, assumptions and escalation
Your result
Your exit work plan brings together data export, replacement capacity, transition timing and minimum service for one service. Use it to prepare the transition further.
Prerequisites
Experience in outsourcing, procurement or service-provider management, and access to contract and register information for a defined service, or willingness to use a case study. No prior DORA legal expertise is required; specific legal questions remain subject to specialist review.
Format and approach
Planned: 5–6 hours of self-study, with templates, annotated specialist counterarguments and self-checks.
Regulatory scope: European Union.
Planned learning time: 5–6 hours