DORA: dates, tool and articles
Implementing Regulation (EU) 2024/2956
The register of information, as the data sheet your customers ask for
Under Article 28(3) of DORA your customer keeps a register of information on every ICT contract and reports it to its authority; Implementing Regulation (EU) 2024/2956 of 29 November 2024 lays down the templates. 19 of the columns are facts about you and the service that the customer has to get from you, one of them the type of service from a taxonomy of 19. Fill them in once, under the column codes and names the Implementing Regulation uses, and every customer's questionnaire gets the same answers.
The provider (template B_05.01)
Who you are, as the register records it: the legal name as in the business register, the identifier and its type, the country of the headquarters, and the ultimate parent.
The service (template B_02.02)
One sheet per service: its type from the Annex III taxonomy, where it is provided, where the data rests and where it is processed, the governing law, the notice periods in calendar days, and the two assessments the customer makes with your input.
The supply chain (template B_05.02)
The customer records every provider in the chain with a rank: you are rank 1, a subcontractor that supports the service is rank 2, its subcontractor rank 3. Point (a) of Article 30(2) asks the same question in the contract.
The customer's own columns (template B_07.01)
These columns are the customer's assessment of you, not your answer; they are listed so you know what the sheet feeds. Substitutability and the exit plan are decided on what you supply about locations, data return and notice periods.
- B_07.01.0050 Substitutability of the ICT third-party service provider
- B_07.01.0070 Date of the last audit on the ICT third-party service provider
- B_07.01.0080 Existence of an exit plan
- B_07.01.0100 Impact of discontinuing the ICT services
- B_07.01.0110 Are there alternative ICT third-party service providers identified?
0 of 19 fields filled in.
The data sheet
# Register of information: vendor data sheet Prepared on from the templates of Implementing Regulation (EU) 2024/2956 of 29 November 2024, read on 12 September 2026. Column codes and names are the Implementing Regulation's; each value is the vendor's declaration for the financial entity's register of information under Article 28(3) of Regulation (EU) 2022/2554. ## The provider (template B_05.01) - B_05.01.0050 Legal name of the ICT third-party service provider: (not filled in) - B_05.01.0060 Name of the ICT third-party service provider in Latin alphabet: (not filled in) - B_05.01.0070 Type of person of the ICT third-party service provider: (not filled in) - B_05.01.0010 Identification code of ICT third-party service provider: (not filled in) - B_05.01.0020 Type of code to identify the ICT third-party service provider: (not filled in) - B_05.01.0080 Country of the ICT third-party service provider’s headquarters: (not filled in) - B_05.01.0110 Identification code of the ICT third-party service provider’s ultimate parent undertaking: (not filled in) - B_05.01.0120 Type of code to identify the ICT third-party service provider’s ultimate parent undertaking: (not filled in) ## The service (template B_02.02) - B_02.02.0060 Type of ICT services: (not filled in) - B_02.02.0130 Country of provision of the ICT services: (not filled in) - B_02.02.0140 Storage of data: (not filled in) - B_02.02.0150 Location of the data at rest (storage): (not filled in) - B_02.02.0160 Location of management of the data (processing): (not filled in) - B_02.02.0120 Country of the governing law of the contractual arrangement: (not filled in) - B_02.02.0100 Notice period for the financial entity making use of the ICT service(s): (not filled in) - B_02.02.0110 Notice period for the ICT third-party service provider: (not filled in) - B_02.02.0170 Sensitiveness of the data stored by the ICT third-party service provider: (not filled in) - B_02.02.0180 Level of reliance on the ICT service supporting the critical or important function.: (not filled in) ## The supply chain (template B_05.02) - B_05.02.0050 Rank: (not filled in) ## The customer's own columns (template B_07.01) These columns are the customer's assessment of you, not your answer; they are listed so you know what the sheet feeds. Substitutability and the exit plan are decided on what you supply about locations, data return and notice periods. - B_07.01.0050 Substitutability of the ICT third-party service provider - B_07.01.0070 Date of the last audit on the ICT third-party service provider - B_07.01.0080 Existence of an exit plan - B_07.01.0100 Impact of discontinuing the ICT services - B_07.01.0110 Are there alternative ICT third-party service providers identified? Keep the sheet with the contract and send the updated version when a location, a subcontractor, a notice period or the parent changes; point (b) of Article 30(2) makes a change of location a notice event. This is not legal advice. The Implementing Regulation is the text to file against.
The locations, the subcontractors and the notice periods are records an ISO 27001 system already keeps
StandardOS holds the supplier register, the asset inventory with its locations and the contract terms per supplier, so the data sheet is exported rather than typed, and the change that makes it stale is a change you already record.
The Article 30 clause checklistDORA for a software vendor, the article