DORA Supplier Risk in Luxembourg: From Messy Supplier Lists to a Register You Can Defend

DORA's third-party ICT risk framework is structured around several linked obligations. For Luxembourg entities within DORA's scope, the legal duties sit primarily with the financial entity. ICT providers are brought into the framework mainly through contractual, information, audit and cooperation requirements. CSSF-supervised entities should read these duties together with Circular CSSF 25/882, while CAA-supervised entities should follow the CAA's DORA instructions. EU oversight of designated critical ICT providers is a separate layer ^{1 5 6}.

Article 28: general principles and governance. Financial entities remain responsible for compliance when they use ICT third-party service providers, must manage ICT third-party risk as an integral component of ICT risk, and must maintain a register of information for contractual arrangements on ICT services ¹. Article 28 is also the basis for mapping ICT services to the functions they support and for assessing risks such as dependency and concentration. Before signing an ICT-service arrangement, the entity must also determine whether it supports a critical or important function, assess the relevant risks and supervisory conditions, perform provider due diligence, and identify conflicts of interest ¹.

Article 29: preliminary assessment of ICT concentration risk. For an arrangement supporting a critical or important function, the financial entity must consider whether the provider is difficult to replace or whether the arrangement would add to multiple dependencies on the same—or closely connected—providers. It must weigh realistic alternatives and, where relevant, consider subcontracting chains, third-country enforcement, insolvency and urgent data recovery ¹.

Article 30: key contractual provisions. DORA creates two layers. Every ICT-service arrangement must cover matters such as the services and functions provided, service and data-processing locations, data protection and recovery, service levels, incident assistance, cooperation with authorities, termination rights and relevant training. Contracts supporting critical or important functions need additional provisions, including measurable service levels, material-change notices, contingency and security requirements, TLPT cooperation, access and audit rights, and workable exit and transition arrangements ¹.

These duties cut across procurement, IT, risk, legal and business ownership. They work only when those teams maintain one consistent set of data and evidence.

A defensible Register of Information usually requires five layers of work.

1. Function mapping. Each ICT service should be linked to the function it supports; an entity may also map that function to its internal processes and service owners. Criticality classification depends on that connection, and DORA's third-party risk framework is built around ICT services supporting critical or important functions ¹.

2. Criticality classification. Every ICT-service arrangement needs a proportionate pre-contract assessment and provider due diligence. Classification then determines which enhanced requirements apply—for example, the Article 29 concentration assessment and the additional Article 30(3) clauses for services supporting critical or important functions ¹.

3. Arrangement and concentration-risk assessment. Assess each contractual arrangement, then aggregate dependencies across the same or closely connected providers. Consider substitutability, relevant subcontractors, third-country exposure and the practical cost and time needed to move the service ^{1 7}. A financial entity with multiple critical services dependent on one hyperscaler has a different exposure from one with genuinely diversified dependencies.

4. Contractual compliance check. Review every ICT-service contract against Article 30(2), then apply the additional Article 30(3) checklist where the service supports a critical or important function. For each gap, record the affected clause, owner, remediation route and target date. This turns legacy-contract issues into a manageable plan ¹.

5. Ongoing monitoring. DORA third-party risk is continuous. Where ICT services supporting critical or important functions are subcontracted, Commission Delegated Regulation (EU) 2025/532 adds specific due-diligence, contractual, notification and ongoing-assessment requirements ⁷. Providers change services, locations, subcontractors, ownership, risk posture, and contractual terms. The Register and the underlying risk file need to change with them ^{1 3}.

Cyvalent 360 Cyber Services / CISOaaS helps run the process: mapping ICT services to supported functions, classifying criticality, assessing arrangements and concentration risk, reviewing contract clauses, preparing Register evidence, and coordinating remediation with business owners, procurement, legal and risk.

Cyvalent RGX keeps the supplier-risk view current: obligations, evidence, contract-review status, controls and open gaps in one place. When providers, services or contracts change, teams can see what changed and what needs action.

For a Luxembourg-ready Register process, Cyvalent 360 Cyber Services can help build and maintain the evidence and operating routine. Cyvalent RGX helps teams track the supporting evidence, decisions and remediation over time.