What DORA is
The Digital Operational Resilience Act — Regulation (EU) 2022/2554 — has applied since 17 January 2025. It sets one standard for how banks, payment and e-money institutions, investment firms, insurers, crypto-asset service providers and other financial entities manage ICT risk.
One of its pillars is ICT third-party risk: a financial entity remains fully responsible for its obligations even when it relies on outside providers, and must manage those providers accordingly.
Does it cover augmented engineers?
That depends on what the engineers do and how the arrangement is set up. External engineers who build, run or have access to ICT systems are often treated as part of an ICT service, and many institutions take the conservative view and bring such arrangements into their DORA processes. Your compliance team should make the call; your engineering team should be ready for it.
What the contract needs
For ICT services, DORA requires specific contractual provisions. Expect your compliance team to ask for:
- a clear description of the services and of the locations where they are performed and where data is processed;
- provisions on availability, integrity, security and confidentiality of data;
- cooperation with the institution and its supervisors, including access, inspection and audit rights;
- termination rights and an exit strategy, so work can move back in-house or to another provider;
- support during ICT incidents.
Financial entities must also keep a register of information covering all contractual arrangements for ICT services — so the arrangement has to be documented in a form that can be entered there.
What to have ready in practice
- Access by least privilege — engineers get the systems their work needs, through your identity provider, and nothing else.
- Same-day offboarding — accounts, keys and devices are revoked when an engagement ends.
- Knowledge kept in your systems — code, documentation and decisions live in your repositories, so exit is possible without disruption.
- Named locations — where each engineer works from is known and written into the contract.
- Incident duties — external engineers know how to report an incident inside your process.
Getting these right from the first engagement is far cheaper than retrofitting them during an audit.
This article is general information, not legal or regulatory advice. Your compliance function and supervisor guidance determine how DORA applies to your institution.