Regulation (EU) 2022/2554
DORA, for a software vendor
Your bank customer is regulated; you meet DORA in its contract, which since 17 January 2025 carries 9 clauses for every ICT service and 6 more for a critical or important function.
Answer above to read the determination for your case; the full tool takes your answers with it.
Continue in the free determinationAt a glance
The dates
Read from the Regulation and the eight acts that fill in its detail, on 12 September 2026. DORA has no amending act.
- 27 December 2022
The Regulation in the Official Journal.
- 13 March 2024
Delegated Regulations (EU) 2024/1773 and 2024/1774: the customer's policy on contracts for critical or important functions, including the due diligence on its vendors, and its ICT risk management tools and processes.
- 13 March 2024
Delegated Regulation (EU) 2024/1772: the six classification criteria and the materiality thresholds that make an ICT-related incident major, among them two hours of downtime on a service supporting a critical or important function.
- 23 October 2024
Delegated Regulation (EU) 2025/301 and Implementing Regulation (EU) 2025/302: the content, time limits and template of the initial notification, intermediate report and final report of a major incident.
- 29 November 2024
Implementing Regulation (EU) 2024/2956: the standard templates of the register of information in which every vendor contract is recorded and reported.
- 17 January 2025
The Regulation applies (Article 64): every new ICT service contract carries the Article 30 clauses, and the registers are filed.
- 13 February 2025
Delegated Regulation (EU) 2025/1190: which financial entities run threat-led penetration testing, the phases, the testers, and the pooled test a vendor may run for several entities.
- 24 March 2025
Delegated Regulation (EU) 2025/532: what the customer assesses when a vendor subcontracts a service supporting a critical or important function.
Three tools, and the standard behind the due diligence
- Free checkWhich side of DORA you are on, and what it carriesThree answers, read by the determination the portal runs. A financial entity carries the register and the incident reports; a provider carries the clauses its customers' contracts put on it.
- Document writerThe Article 30 clauses, with a status for eachThe 9 clauses of every contract, the 6 for a critical or important function and the 12 subcontracting terms of Delegated Regulation (EU) 2025/532, verbatim in your language, each with the ISO 27001 records that answer it; a status and a note per clause, written as the document to send back.
- Document writerThe register of information, as your data sheetEvery customer files the same templates about you. The columns that are facts about the vendor and the service, with their codes and names from the Implementing Regulation, answered once and written as the sheet to send with the contract.
- Document writerThe vendor questionnaire, written by the RegulationFor the financial entity's side: the 21 items of Delegated Regulation (EU) 2024/1773 a policy must make it ask a vendor, in the Regulation's words, assembled into the questionnaire with the assurance elements and audit methods the entity uses, and the evidence an ISO 27001 system produces under each.
- GuideISO 27001, the standard the due diligence asks forArticle 28(5) makes appropriate information security standards a condition of contracting at all; the 93 Annex A controls and the clause register are the answer a customer's questionnaire expects.
- GuideThe Annex A controls, one page eachEvery control with its objective and the evidence it produces, in six languages; the clause checklist points at them by reference.
- MappingNIS2 mapped to ISO 27001A bank's vendor is often a NIS2 entity in its own right; the Implementing Regulation's sections against the same controls.
Every free template on one page
9 articles, from the primary sources
- ArticleDORA for a software vendor: the Article 30 contract clauses your bank customer will send, the register of information you will appear in, and what ISO 27001 already answersSince 17 January 2025 every bank, insurer, investment firm and payment institution in the Union manages its software vendors under Regulation (EU) 2022/2554, DORA.
- ArticleDORA's nineteen types of ICT service, S01 to S19: which one a SaaS product is, what the register of information records about it, and why one contract can be several rowsEvery ICT service a bank, insurer or payment institution buys is recorded in its register of information under one of nineteen codes, S01 to S19, from Annex III of Implementing Regulation (EU) 2024/2956.
- ArticleSubcontracting under DORA, RTS 2025/532: ten conditions your customer checks, twelve terms your contract carries, a notice period before you change a subcontractorIn force since 22 July 2025 for every ICT service supporting a critical or important function: Delegated Regulation (EU) 2025/532 gives the customer ten conditions to assess before allowing subcontracting, twelve terms the contract then carries, from your responsibility for the subcontractor's service to the customer's termination rights, and a notice period before any material change to a subcontractor.
- ArticleYour bank's DORA vendor policy, RTS 2024/1773: the six due-diligence questions, the five sources of assurance, the eight conditions for accepting your ISO 27001 certificate in place of an audit, and the five reports you will oweEvery financial entity in the Union has a written policy on its contracts for ICT services supporting critical or important functions, and Delegated Regulation (EU) 2024/1773 says what that policy must contain, in force since 15 July 2024.
- ArticleWhen your outage becomes your bank customer's major incident: DORA's six criteria, the two-hour downtime threshold of RTS 2024/1772, the four-hour, 24-hour, 72-hour and one-month clocks of RTS 2025/301, and the facts your customer will need from youA financial entity must report a major ICT-related incident to its supervisor within four hours of classifying it and no later than 24 hours from becoming aware, follow up within 72 hours and close within one month.
- ArticleThe nine places where your bank customer's ICT risk framework reaches into your product, RTS 2024/1774: support end dates, vulnerability reports and library tracking, settings you may not let it bypass, source code tested before production, named accounts for your staff, and your incidents as its alarmsDelegated Regulation (EU) 2024/1774, in force since 15 July 2024, specifies the ICT risk management framework every financial entity runs under DORA, and nine of its articles name the ICT third-party service provider.
- ArticleThreat-led penetration testing under DORA, from the vendor's side: when your bank customer's red team is allowed into your production systems, the 12-week test of RTS 2025/1190, the pooled test you can run instead, and what the contract already saysArticle 26 of DORA makes the largest financial entities run a threat-led penetration test on live production systems at least every 3 years, covering the critical or important functions they have outsourced, and Article 30(3)(d) puts the vendor's participation into the contract.
- ArticleISO 27001 vs SOC 2 in Europe: which one buyers actually ask forSelling into Europe, get ISO 27001: EU public tenders named it 3,405 times in a year against 104 for SOC 2, and led in every one of the twelve months behind that number.
- ArticleCRA or NIS2: which one applies to a software company, and can it be both?The Cyber Resilience Act regulates products placed on the market; NIS2 regulates entities that provide services.
What it asks of you
158 requirements in 4 groups
Obligations
112- 5(1) Put an internal governance framework over ICT risk
- 5(2) Have the management body approve and own the framework
- 5(3) Name someone to monitor your ICT third-party contracts
and 109 more
Duties
4- RTS 5(1) Announce subcontracting changes early enough to assess
- RTS 5(3) Change subcontracting only after approval or no objection
- 26(3) Take part in the TLPT when in its scope
and 1 more
Clauses
39- 31(5) Respond to the designation within six weeks
- 31(11) Ask to be designated critical if you choose
- 35(1) Know the powers the Lead Overseer holds over you
and 36 more
Deadlines
3- 301-5(1)(a) Support the initial report within four hours of classification
- 301-5(1)(b) Support the intermediate report 72 hours after the first
- 301-5(1)(c) Support the final report a month after the intermediate
13 of the 15 clauses are answered by an ISO 27001 record
StandardOS keeps the ISO 27001 records a financial customer's due diligence and audit right ask for, in one workspace, in six languages: supplier register, backups and restore tests, incident process, continuity plan, internal audits, the Statement of Applicability.
Dates are read from the Regulation and the acts named and never typed on this page. This is not legal advice, and the Regulation is the text to read: Regulation (EU) 2022/2554.
Related:ArticlesFree tools