Short answer
Article 28(3) of DORA requires a register of information on all contractual arrangements for ICT services provided by third-party service providers. The register must show the provider, the contract, the function supported, the data and systems involved, the exit strategy and the risk. The ITS 2024/2956 template is the supervisory format; a working CSV is only an internal collection tool.
What the register must show
- Provider: legal name, identifier, country, group and chain of subcontractors.
- Contract: reference, start and end, renewal, termination and governing law.
- Function: the business or ICT function supported and whether it is critical or important.
- Data: personal data, confidential data and data location.
- Systems: the systems and processes that depend on the service.
- Risk: concentration, substitutability, exit plan and supervisory relevance.
Working template and official format
Use a controlled working file to collect evidence, then map it to the official ITS template before submission. A working CSV is useful because contracts, owners and systems change; the official file is the reporting artifact.
For the Estonian submission context and the difference between the working CSV and the official ITS template, see DORA in Estonia and the Estonian register guide.
How to fill it
- Start from contracts, not a spreadsheet. Collect signed contracts, statements of work and change orders.
- Assign one owner per row. The business owner confirms the function; legal confirms the contract; security confirms data and access.
- Map subcontractors. Do not hide a critical subcontractor inside a provider row.
- Record the exit plan. A register without substitutability and exit evidence is incomplete.
- Review before reporting. Reconcile rows with the contract register and the incident/asset inventories.
Common errors
- Treating the CSV as the official submission.
- One row per provider instead of one row per contractual arrangement.
- Missing subcontractors or data locations.
- Marking every service as non-critical to avoid scrutiny.
- No named owner, review date or evidence link.
- Copying last year's register without checking changes.
Submission in Estonia
Estonian financial entities submit through the supervisory channel set by the Financial Supervision Authority. Confirm the current format and deadline before sending. The register is also useful evidence for an ICT audit, a DORA gap review or a customer due-diligence request.
Request a register review if you need a second pair of eyes before submission.
Frequently asked questions
Is the DORA register of information the same as the ITS template?
The register is the substantive record required by Article 28(3). The ITS 2024/2956 template is the supervisory format used to submit that record. A working CSV helps you collect the data, but it does not replace the official template.
Who must maintain the register?
Financial entities in scope of DORA must maintain a register of information on all contractual arrangements for ICT services provided by third-party service providers.
How often should it be updated?
Keep it current as contracts, providers and functions change. Review it at least before supervisory reporting and after material outsourcing or ICT changes.
Does a completed CSV prove DORA compliance?
No. The register is one evidence artifact. DORA also requires governance, ICT risk management, incident processes, resilience testing and contractual safeguards.