DORA ICT Third-Party Questionnaire: How to Answer It

A DORA ICT third-party questionnaire is the due-diligence form an EU bank, insurer, investment firm or other financial entity sends an ICT supplier. It uses your answers to assess the risk of relying on you under the Digital Operational Resilience Act, Regulation (EU) 2022/2554. The regulation contains no supplier questionnaire for customers to copy, so every customer writes its own version. Most of the questions still lead back to a few articles on ICT third-party risk. To answer one, work out which article each question serves, attach evidence you already hold, and send anything that depends on contract wording to whoever owns your contracts.

This is operational guidance, not legal advice. Whether DORA applies to a particular customer relationship, and what your contracts should say, is a question for that customer and for qualified counsel. What follows explains how to run the response so that each answer can be traced, checked and defended.

What the customer is actually collecting, and why the questions differ

The questionnaire looks different every time because two customers subject to the same regulation each turn it into their own vendor-onboarding process. Under the wording, though, the questions usually cover three things: data the customer has to record about you, evidence about your controls, and terms the customer wants in the contract.

Some terms come up in nearly every questionnaire:

• Financial entity: the regulated customer, such as a credit institution, insurer, payment institution or investment firm. The scope list is in Article 2 of the regulation.
• ICT third-party service provider: you, if you deliver digital or data services to that entity.
• Critical or important function: a function whose disruption would materially impair the customer's performance or compliance. Whether your service supports one is decided by the customer, and that decision sets how deep the questionnaire goes.
• Register of information: the customer's structured record of all its ICT third-party arrangements, which Article 28(3) of the regulation addresses.

The register of information explains the "boring" fields

When a questionnaire opens with legal entity names, identifiers, service descriptions, data locations and a list of your subcontractors, it is filling in the customer's register. The register's standard templates are set out in Commission Implementing Regulation (EU) 2024/2956. Read the templates once. You will see why customers ask for exactly those fields, often in that order, and why "see our website" does not work as an answer.

These questions are low-risk to answer and expensive to get wrong. An entity name that doesn't match the contracting party, or a subcontractor list that leaves out a hosting provider, ends up in the customer's records. Fixing it later takes a follow-up thread.

"Critical or important" changes the depth, not the topic

If the customer classifies your service as supporting a critical or important function, expect longer sections on exit planning, audit access, business continuity testing and service levels with quantified targets. The topics stay the same and the evidence bar goes up. Ask the customer early how it has classified your service. The questionnaire often doesn't say, and the classification tells you how much evidence to prepare.

Map every question to one of six sources before you answer

Sort all the questions first, before anyone drafts an answer. Each DORA ICT third-party question usually comes from one of six places. The source tells you who should answer it and what counts as proof.

Article numbers refer to Regulation (EU) 2022/2554. Check the consolidated text yourself before you cite an article back to a customer. Sorting by source answers the question that matters most: is this answered from a policy, from operational records or from the contract? Answers in the first two groups can be reused across questionnaires. Answers in the third depend on what you actually signed with that customer.

The contract half: 15 clause areas a policy cannot answer

The most common mistake in DORA questionnaires is answering a contract question with a policy. "Do you provide unrestricted rights of access, inspection and audit?" is not answered by your audit policy. It is answered by what your agreement with this customer says, or by what you are willing to agree to.

Article 30(2) of the regulation lists nine contractual elements for ICT services in general. Article 30(3) adds six more where the service supports critical or important functions. That gives 15 clause areas. Every questionnaire item that touches one of them should go to whoever owns your contracts, not to the security team. The summaries below are paraphrased, so read the official text for the exact wording.

Nine baseline areas (Article 30(2), points a–i)

1. Description of the functions and services, including whether subcontracting is permitted and on what conditions
2. Locations where services are provided and data is processed, with notice of planned changes
3. Data protection: availability, authenticity, integrity and confidentiality
4. Access, recovery and return of data, including on insolvency or termination
5. Service level descriptions
6. Assistance during an ICT incident related to the service, at no extra cost or at a cost set in advance
7. Cooperation with the customer's competent authorities
8. Termination rights and minimum notice periods
9. Participation in the customer's ICT security awareness programmes and digital resilience training

Six additional areas for critical or important functions (Article 30(3), points a–f)

1. Full service level descriptions with precise quantitative and qualitative targets
2. Notice periods and reporting duties towards the customer
3. Implementing and testing business contingency plans and ICT security measures
4. Participation in the customer's threat-led penetration testing
5. Unrestricted rights of access, inspection and audit
6. Exit strategies, including a mandatory adequate transition period

The policy for using ICT services that support critical or important functions is detailed further in Commission Delegated Regulation (EU) 2024/1773. That text is addressed to the financial entity, not to you. It still predicts the follow-up questions: monitoring, performance reviews and exit planning come straight from it.

Decision rule: if a question can be answered truthfully with "it depends on our agreement with you", it belongs in the contract lane. Answer it with a clause reference, or with "to be agreed in contract, see redline" and a named owner. Do not answer it with a yes copied from a policy.

A worked triage model for a 140-question questionnaire

The figures below are fictional planning assumptions, not measurements. Swap in your own timings after your first two or three DORA questionnaires. The model shows where the time actually goes.

Under these assumptions, contract-dependent questions make up about one fifth of the form and about two fifths of the effort. They are also the answers that need someone outside the security team. So send lane C to legal on the day the questionnaire arrives, not after the security answers are done. If lane C waits until the end, the whole response waits for legal's availability.

Lanes A and B are where an answer library and evidence-backed drafting help most, because the answers repeat across customers. Lane D repeats in structure but not in values: your exit method stays the same while the transition period differs per contract.

What typically goes wrong

• Policy answers to contract questions. Lane C is answered "yes" from the security policy, and the customer later points to that answer during negotiation. You find out at redline time, when the customer's lawyer quotes your questionnaire back to you.
• A stale subcontractor list. The list attached in March no longer matches your subprocessor page by November. Put one date on the list and attach it to every questionnaire, rather than retyping it into free text.
• Certification scope stretched too far. "We are ISO 27001 certified" is used to answer a question about a service or location outside the certificate's scope. Quote the scope statement instead. The ISO 27001 approach of citing scope, not the badge, works here unchanged.
• Agreeing to unlimited audit rights in a free-text box. Someone answering quickly writes "yes, on request". Under Article 30(3)(e) the customer may read that as a commitment. Route it to the contract lane.
• Answering for the wrong classification. You prepare light answers, and the customer has in fact classified your service as supporting a critical or important function.

Planning for November and December

If your customers renew vendor contracts or re-run supplier assessments at year end, DORA questionnaires and contract redlines tend to arrive together. That makes the contract lane the bottleneck just as reviewers take holiday. Three things can be done in advance:

1. Date-stamp the reusable pack: entity data, service descriptions, data locations, subcontractor list, continuity test summary and incident contact routes, each with an owner and a "valid as of" date.
2. Pre-agree positions on the 15 clause areas with whoever owns your contracts: what you offer by default, what you will negotiate, and what you won't agree to. A one-page position sheet lets the security team route lane C questions without guessing.
3. Book reviewer time for the last weeks of the year if your pipeline shows financial-sector renewals. Use your own history to set the hours. Don't use the fictional numbers above.

Don't invent regulatory deadlines for your customers. If a customer cites a date it has to meet, ask which provision or supervisory request it comes from, and check that yourself.

Where drafting tools fit, and where they stop

Tooling cannot decide your contract position or the customer's classification. It can help with lanes A, B and D: finding the right passage in your own documents, citing it, and making sure a person approves every answer before anything leaves the building.

Compliance Concierge works that way. It drafts answers from the policies and evidence you upload, cites the source document for each answer, and won't export until a human reviewer has approved the answers. It is hosted in Frankfurt. It does not tell you whether DORA applies, and it does not guarantee that a customer will accept your answers. Treat a cited draft as a starting point for the reviewer, not as the answer itself.

If your team is setting up a repeatable process instead of handling one questionnaire, the five-stage vendor risk assessment model shows the buyer's side of the same exchange. It helps to know what a customer's tiering step does with your answers.

FAQ

Do you need compliance questionnaire software to answer a DORA ICT third-party questionnaire?

Not necessarily. A one-off questionnaire can be handled with a spreadsheet, a dated evidence folder and a clear owner for the contract lane. Software starts to pay off when the same register, control and incident questions come back from several financial-sector customers and you want each answer cited and reviewed. Our 14-point buying framework for compliance questionnaire software covers what to test before you commit, including review gates and file fidelity for customer-specific Excel templates.