Art.28(1) General principles for ICT third-party risk management
What the standard requires
1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and in accordance with the following principles: (a) financial entities that have in place contractual arrangements for the use of ICT services to run their business operations shall, at all times, remain fully responsible for compliance with, and the discharge of, all obligations under this Regulation and applicable financial services law; (b) financial entities’ management of ICT third-party risk shall be implemented in light of the principle of proportionality, taking into account: (i) the nature, scale, complexity and importance of ICT-related dependencies, (ii) the risks arising from contractual arrangements on the use of ICT services concluded with ICT third-party service providers, taking into account the criticality or importance of the respective service, process or function, and the potential impact on the continuity and availability of financial services and activities, at individual and at group level.
Quoted verbatim from Regulation (EU) 2022/2554 (DORA), which is in the public domain.
Maps to 1 control in 1 other framework
| Framework | Control |
|---|---|
| NIST Cybersecurity Framework (1.1, legacy) | ID.SC-1 Supply chain risk management processes established |
Mappings are CMDash’s own, seeded with the product and shown on both frameworks they connect. In the product they mean evidence you attach here also counts against the controls listed above.
In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.