{ "schema_version": "0.1.0", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "title": "DORA Article 28 RTS/ITS Pack — entity-level RoI, third-party-policy and subcontracting controls", "cluster": "authority", "last_reviewed": "2026-05-10", "evidence_cutoff": "2026-05-10", "publisher": { "name": "Finray Technologies Ltd", "url": "https://finray.tech", "legal_form": "Cyprus Limited Company", "registry": "Cyprus Companies Registry HE 445903" }, "license": "https://creativecommons.org/licenses/by/4.0/", "citation_attribution": "Finray Intelligence; finray.tech", "review_methodology": "https://finray.tech/intelligence/methodology/", "related_surfaces": { "editorial_html": "https://finray.tech/intelligence/dora-rts-its-pack/", "editorial_markdown": "https://finray.tech/intelligence/dora-rts-its-pack.md", "graph_dataset_json": "https://finray.tech/intelligence/dora-rts-its-pack.json", "site_manifest": "https://finray.tech/agents.json", "llms_txt": "https://finray.tech/llms.txt", "llms_full_txt_intelligence": "https://finray.tech/intelligence/llms-full.txt" }, "citations_count": 132, "citations": [ { "primary_source_url": "https://acpr.banque-france.fr/en/european-and-international/dora-regulation-eu-20222554", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "regulator-acpr-dora-portal", "label": "ACPR DORA portal", "type": "regulator", "subtype": "national competent authority DORA portal", "role": "ACPR DORA portal is a national competent authority portal for DORA implementation evidence." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://finance.ec.europa.eu/regulation-and-supervision/financial-services-legislation/implementing-and-delegated-acts/digital-operational-resilience-regulation_en", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "european-commission", "label": "European Commission", "type": "regulator", "subtype": "EU public authority or public-source body", "role": "European Commission is a public authority or public-source body used for DORA RTS/ITS evidence." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.bafin.de/EN/Aufsicht/Bankenaufsicht/EinheitlicherAufsichtsmechanismus/DORA/dora_node_en.html", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "regulator-bafin-dora-portal", "label": "BaFin DORA implementation portal", "type": "regulator", "subtype": "national competent authority DORA portal", "role": "BaFin DORA implementation portal is a national competent authority portal for DORA implementation evidence." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.cssf.lu/en/ict-and-cyber-risk-for-dora-entities/", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "regulator-cssf-dora-portal", "label": "CSSF DORA pages (Luxembourg)", "type": "regulator", "subtype": "national competent authority DORA portal", "role": "CSSF DORA pages (Luxembourg) is a national competent authority portal for DORA implementation evidence." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/activities/direct-supervision-and-oversight/digital-operational-resilience-act/preparation-dora-application", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "eba", "label": "European Banking Authority", "type": "regulator", "subtype": "EU public authority or public-source body", "role": "European Banking Authority is a public authority or public-source body used for DORA RTS/ITS evidence." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/publications-and-media/press-releases/esas-publish-list-critical-third-party-providers-under-dora", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "esas-joint-committee", "label": "ESAs Joint Committee", "type": "regulator", "subtype": "EU public authority or public-source body", "role": "ESAs Joint Committee is a public authority or public-source body used for DORA RTS/ITS evidence." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eiopa.europa.eu/esas-publish-list-critical-third-party-providers-under-dora-2025-11-18_en", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "eiopa", "label": "European Insurance and Occupational Pensions Authority", "type": "regulator", "subtype": "EU public authority or public-source body", "role": "European Insurance and Occupational Pensions Authority is a public authority or public-source body used for DORA RTS/ITS evidence." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.enisa.europa.eu/topics/cybersecurity-policy/nis-directive/finance", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "enisa", "label": "ENISA", "type": "regulator", "subtype": "EU public authority or public-source body", "role": "ENISA is a public authority or public-source body used for DORA RTS/ITS evidence." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.esma.europa.eu/digital-finance-and-innovation/digital-operational-resilience-act-dora", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "esma", "label": "European Securities and Markets Authority", "type": "regulator", "subtype": "EU public authority or public-source body", "role": "European Securities and Markets Authority is a public authority or public-source body used for DORA RTS/ITS evidence." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.mfsa.mt/our-work/financial-services-regulation/dora/", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "regulator-mfsa-dora-portal", "label": "MFSA DORA implementation circulars (Malta)", "type": "regulator", "subtype": "national competent authority DORA portal", "role": "MFSA DORA implementation circulars (Malta) is a national competent authority portal for DORA implementation evidence." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1502/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "commission-delegated-regulation-2024-1502", "label": "Commission Delegated Regulation (EU) 2024/1502 — RTS on criticality criteria", "type": "regulation", "subtype": "companion Commission delegated regulation", "role": "Commission Delegated Regulation (EU) 2024/1502 — RTS on criticality criteria is a companion Commission act inside the DORA Article 28-35 perimeter." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1505/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "commission-delegated-regulation-2024-1505", "label": "Commission Delegated Regulation (EU) 2024/1505 — RTS on Lead Overseer oversight fees", "type": "regulation", "subtype": "companion Commission delegated regulation", "role": "Commission Delegated Regulation (EU) 2024/1505 — RTS on Lead Overseer oversight fees is a companion Commission act inside the DORA Article 28-35 perimeter." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1772/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "commission-delegated-regulation-2024-1772", "label": "Commission Delegated Regulation (EU) 2024/1772 — RTS on ICT-related incident classification", "type": "regulation", "subtype": "companion Commission delegated regulation", "role": "Commission Delegated Regulation (EU) 2024/1772 — RTS on ICT-related incident classification is a companion Commission act inside the DORA Article 28-35 perimeter." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "commission-delegated-regulation-2024-1773", "label": "Commission Delegated Regulation (EU) 2024/1773 — RTS on ICT third-party policy", "type": "regulation", "subtype": "DORA RTS/ITS implementing act", "role": "Commission Delegated Regulation (EU) 2024/1773 — RTS on ICT third-party policy is a regulatory anchor for the DORA Article 28 RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1774/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "commission-delegated-regulation-2024-1774", "label": "Commission Delegated Regulation (EU) 2024/1774 — RTS on ICT risk management", "type": "regulation", "subtype": "companion Commission delegated regulation", "role": "Commission Delegated Regulation (EU) 2024/1774 — RTS on ICT risk management is a companion Commission act inside the DORA Article 28-35 perimeter." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2025/295/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "commission-delegated-regulation-2025-295", "label": "Commission Delegated Regulation (EU) 2025/295 — RTS on oversight conduct", "type": "regulation", "subtype": "companion Commission delegated regulation", "role": "Commission Delegated Regulation (EU) 2025/295 — RTS on oversight conduct is a companion Commission act inside the DORA Article 28-35 perimeter." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2025/420/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "commission-delegated-regulation-2025-420", "label": "Commission Delegated Regulation (EU) 2025/420 — RTS on Joint Examination Teams", "type": "regulation", "subtype": "companion Commission delegated regulation", "role": "Commission Delegated Regulation (EU) 2025/420 — RTS on Joint Examination Teams is a companion Commission act inside the DORA Article 28-35 perimeter." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2025/532/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "commission-delegated-regulation-2025-532", "label": "Commission Delegated Regulation (EU) 2025/532 — RTS on subcontracting", "type": "regulation", "subtype": "DORA RTS/ITS implementing act", "role": "Commission Delegated Regulation (EU) 2025/532 — RTS on subcontracting is a regulatory anchor for the DORA Article 28 RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "commission-implementing-regulation-2024-2956", "label": "Commission Implementing Regulation (EU) 2024/2956 — ITS on RoI templates", "type": "regulation", "subtype": "DORA RTS/ITS implementing act", "role": "Commission Implementing Regulation (EU) 2024/2956 — ITS on RoI templates is a regulatory anchor for the DORA Article 28 RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "dora-2022-2554", "label": "Regulation (EU) 2022/2554 (DORA)", "type": "regulation", "subtype": "parent regulation", "role": "Regulation (EU) 2022/2554 (DORA) is a regulatory anchor for the DORA Article 28 RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "dora-article-28", "label": "DORA Article 28", "type": "regulation", "subtype": "DORA article anchor", "role": "DORA Article 28 is a regulatory anchor for the DORA Article 28 RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "dora-article-29", "label": "DORA Article 29", "type": "regulation", "subtype": "DORA article anchor", "role": "DORA Article 29 is a regulatory anchor for the DORA Article 28 RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "dora-article-30", "label": "DORA Article 30", "type": "regulation", "subtype": "DORA article anchor", "role": "DORA Article 30 is a regulatory anchor for the DORA Article 28 RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "dora-article-31", "label": "DORA Article 31", "type": "regulation", "subtype": "DORA article anchor", "role": "DORA Article 31 is a regulatory anchor for the DORA Article 28 RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "dora-article-32", "label": "DORA Article 32", "type": "regulation", "subtype": "DORA article anchor", "role": "DORA Article 32 is a regulatory anchor for the DORA Article 28 RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "dora-article-33", "label": "DORA Article 33", "type": "regulation", "subtype": "DORA article anchor", "role": "DORA Article 33 is a regulatory anchor for the DORA Article 28 RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "dora-article-34", "label": "DORA Article 34", "type": "regulation", "subtype": "DORA article anchor", "role": "DORA Article 34 is a regulatory anchor for the DORA Article 28 RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "dora-article-35", "label": "DORA Article 35", "type": "regulation", "subtype": "DORA article anchor", "role": "DORA Article 35 is a regulatory anchor for the DORA Article 28 RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "nis2-directive-2022-2555", "label": "Directive (EU) 2022/2555 (NIS2)", "type": "standard", "subtype": "reference standard or adjacent legal framework", "role": "Directive (EU) 2022/2555 (NIS2) is an adjacent standard or legal framework used for control-context mapping." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.iso.org/isoiec-27001-information-security.html", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "iso-27001", "label": "ISO/IEC 27001", "type": "standard", "subtype": "reference standard or adjacent legal framework", "role": "ISO/IEC 27001 is an adjacent standard or legal framework used for control-context mapping." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "pol-01", "label": "Management-body adoption of written policy", "type": "control", "subtype": "third-party-policy control", "role": "Management-body adoption of written policy is an entity-level third-party-policy control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "pol-02", "label": "Annual review and timely update cadence", "type": "control", "subtype": "third-party-policy control", "role": "Annual review and timely update cadence is an entity-level third-party-policy control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "pol-03", "label": "Methodology for determining ICT services supporting critical or important functions", "type": "control", "subtype": "third-party-policy control", "role": "Methodology for determining ICT services supporting critical or important functions is an entity-level third-party-policy control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "pol-04", "label": "Internal responsibilities and skills for approval, management, control and documentation", "type": "control", "subtype": "third-party-policy control", "role": "Internal responsibilities and skills for approval, management, control and documentation is an entity-level third-party-policy control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "pol-05", "label": "Independent review or audit plan", "type": "control", "subtype": "third-party-policy control", "role": "Independent review or audit plan is an entity-level third-party-policy control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "pol-06", "label": "Lifecycle governance for contractual arrangements", "type": "control", "subtype": "third-party-policy control", "role": "Lifecycle governance for contractual arrangements is an entity-level third-party-policy control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "pol-08", "label": "Pre-contract risk assessment, including legal, operational, ICT, reputational, confidentiality, data, availability, location and concentration risks", "type": "control", "subtype": "third-party-policy control", "role": "Pre-contract risk assessment, including legal, operational, ICT, reputational, confidentiality, data, availability, location and concentration risks is an entity-level third-party-policy control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "pol-09", "label": "Due diligence on ICT TPP ability, expertise, resources and information-security standards", "type": "control", "subtype": "third-party-policy control", "role": "Due diligence on ICT TPP ability, expertise, resources and information-security standards is an entity-level third-party-policy control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "pol-10", "label": "Use and limitation of audits, certifications and third-party reports", "type": "control", "subtype": "third-party-policy control", "role": "Use and limitation of audits, certifications and third-party reports is an entity-level third-party-policy control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "pol-11", "label": "Conflicts-of-interest assessment, including intra-group arrangements", "type": "control", "subtype": "third-party-policy control", "role": "Conflicts-of-interest assessment, including intra-group arrangements is an entity-level third-party-policy control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "pol-12", "label": "Contractual clauses aligned with DORA Article 30(2) and 30(3)", "type": "control", "subtype": "third-party-policy control", "role": "Contractual clauses aligned with DORA Article 30(2) and 30(3) is an entity-level third-party-policy control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "pol-13", "label": "Access, inspection, audit and ICT testing rights", "type": "control", "subtype": "third-party-policy control", "role": "Access, inspection, audit and ICT testing rights is an entity-level third-party-policy control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "pol-14", "label": "Ongoing service monitoring and incident/service/security reporting", "type": "control", "subtype": "third-party-policy control", "role": "Ongoing service monitoring and incident/service/security reporting is an entity-level third-party-policy control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "pol-16", "label": "Documented exit plan for each C/I supporting ICT contractual arrangement", "type": "control", "subtype": "third-party-policy control", "role": "Documented exit plan for each C/I supporting ICT contractual arrangement is an entity-level third-party-policy control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2025/532/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "sub-01", "label": "Subcontracting risk factors determined before use", "type": "control", "subtype": "subcontracting-chain control", "role": "Subcontracting risk factors determined before use is an entity-level subcontracting-chain control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2025/532/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "sub-03", "label": "Pre-contract decision whether subcontracting is permitted", "type": "control", "subtype": "subcontracting-chain control", "role": "Pre-contract decision whether subcontracting is permitted is an entity-level subcontracting-chain control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2025/532/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "sub-04", "label": "Due diligence on ICT TPP subcontractor selection and assessment processes", "type": "control", "subtype": "subcontracting-chain control", "role": "Due diligence on ICT TPP subcontractor selection and assessment processes is an entity-level subcontracting-chain control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2025/532/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "sub-05", "label": "Provider capacity to identify all relevant subcontractors and provide information", "type": "control", "subtype": "subcontracting-chain control", "role": "Provider capacity to identify all relevant subcontractors and provide information is an entity-level subcontracting-chain control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2025/532/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "sub-06", "label": "Contractual conditions allow the financial entity to comply with DORA", "type": "control", "subtype": "subcontracting-chain control", "role": "Contractual conditions allow the financial entity to comply with DORA is an entity-level subcontracting-chain control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2025/532/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "sub-07", "label": "Same access and inspection rights through the chain", "type": "control", "subtype": "subcontracting-chain control", "role": "Same access and inspection rights through the chain is an entity-level subcontracting-chain control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2025/532/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "sub-08", "label": "Contract identifies C/I ICT services or material parts eligible for subcontracting", "type": "control", "subtype": "subcontracting-chain control", "role": "Contract identifies C/I ICT services or material parts eligible for subcontracting is an entity-level subcontracting-chain control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2025/532/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "sub-09", "label": "Direct ICT TPP remains responsible despite subcontracting", "type": "control", "subtype": "subcontracting-chain control", "role": "Direct ICT TPP remains responsible despite subcontracting is an entity-level subcontracting-chain control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2025/532/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "sub-10", "label": "Ongoing monitoring and reporting of subcontracted C/I services", "type": "control", "subtype": "subcontracting-chain control", "role": "Ongoing monitoring and reporting of subcontracted C/I services is an entity-level subcontracting-chain control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2025/532/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "sub-11", "label": "Location, data-processing and data-storage risk assessment through chain", "type": "control", "subtype": "subcontracting-chain control", "role": "Location, data-processing and data-storage risk assessment through chain is an entity-level subcontracting-chain control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2025/532/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "sub-13", "label": "Advance notification of intended material subcontracting changes", "type": "control", "subtype": "subcontracting-chain control", "role": "Advance notification of intended material subcontracting changes is an entity-level subcontracting-chain control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2025/532/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "sub-14", "label": "Buyer assessment, objection and modification right for material subcontracting changes", "type": "control", "subtype": "subcontracting-chain control", "role": "Buyer assessment, objection and modification right for material subcontracting changes is an entity-level subcontracting-chain control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_del/2025/532/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "sub-15", "label": "Termination right for unauthorised or objected subcontracting changes", "type": "control", "subtype": "subcontracting-chain control", "role": "Termination right for unauthorised or objected subcontracting changes is an entity-level subcontracting-chain control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-01", "label": "LEI of the financial entity maintaining the RoI", "type": "control", "subtype": "RoI field control", "role": "LEI of the financial entity maintaining the RoI is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-02", "label": "Name of the financial entity", "type": "control", "subtype": "RoI field control", "role": "Name of the financial entity is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-03", "label": "Country of the financial entity", "type": "control", "subtype": "RoI field control", "role": "Country of the financial entity is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-04", "label": "Type of financial entity", "type": "control", "subtype": "RoI field control", "role": "Type of financial entity is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-05", "label": "Hierarchy within group", "type": "control", "subtype": "RoI field control", "role": "Hierarchy within group is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-07", "label": "Value of total assets", "type": "control", "subtype": "RoI field control", "role": "Value of total assets is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-09", "label": "Contractual arrangement reference number", "type": "control", "subtype": "RoI field control", "role": "Contractual arrangement reference number is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-10", "label": "Type of contractual arrangement", "type": "control", "subtype": "RoI field control", "role": "Type of contractual arrangement is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-11", "label": "Overarching contractual arrangement reference number", "type": "control", "subtype": "RoI field control", "role": "Overarching contractual arrangement reference number is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-13", "label": "Annual expense or estimated cost", "type": "control", "subtype": "RoI field control", "role": "Annual expense or estimated cost is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-14", "label": "Identification code of the ICT TPP signing/providing service", "type": "control", "subtype": "RoI field control", "role": "Identification code of the ICT TPP signing/providing service is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-15", "label": "Type of code used to identify ICT TPP", "type": "control", "subtype": "RoI field control", "role": "Type of code used to identify ICT TPP is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-16", "label": "Function identifier", "type": "control", "subtype": "RoI field control", "role": "Function identifier is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-17", "label": "Type of ICT services", "type": "control", "subtype": "RoI field control", "role": "Type of ICT services is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-18", "label": "Start date of contractual arrangement", "type": "control", "subtype": "RoI field control", "role": "Start date of contractual arrangement is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-19", "label": "End date of contractual arrangement", "type": "control", "subtype": "RoI field control", "role": "End date of contractual arrangement is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-21", "label": "Notice period for the financial entity", "type": "control", "subtype": "RoI field control", "role": "Notice period for the financial entity is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-22", "label": "Notice period for the ICT TPP", "type": "control", "subtype": "RoI field control", "role": "Notice period for the ICT TPP is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-23", "label": "Country of governing law", "type": "control", "subtype": "RoI field control", "role": "Country of governing law is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-24", "label": "Country of ICT service provision", "type": "control", "subtype": "RoI field control", "role": "Country of ICT service provision is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-25", "label": "Storage of data", "type": "control", "subtype": "RoI field control", "role": "Storage of data is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-26", "label": "Location of data at rest", "type": "control", "subtype": "RoI field control", "role": "Location of data at rest is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-27", "label": "Location of data processing and management", "type": "control", "subtype": "RoI field control", "role": "Location of data processing and management is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-28", "label": "Data sensitivity", "type": "control", "subtype": "RoI field control", "role": "Data sensitivity is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-29", "label": "Level of reliance on ICT service", "type": "control", "subtype": "RoI field control", "role": "Level of reliance on ICT service is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-30", "label": "ICT service supply-chain rank", "type": "control", "subtype": "RoI field control", "role": "ICT service supply-chain rank is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-31", "label": "Recipient of subcontracted ICT services", "type": "control", "subtype": "RoI field control", "role": "Recipient of subcontracted ICT services is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-32", "label": "Criticality or importance assessment", "type": "control", "subtype": "RoI field control", "role": "Criticality or importance assessment is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-33", "label": "Date of last criticality assessment", "type": "control", "subtype": "RoI field control", "role": "Date of last criticality assessment is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-34", "label": "Recovery time objective (RTO)", "type": "control", "subtype": "RoI field control", "role": "Recovery time objective (RTO) is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-35", "label": "Recovery point objective (RPO)", "type": "control", "subtype": "RoI field control", "role": "Recovery point objective (RPO) is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-36", "label": "Substitutability of ICT TPP", "type": "control", "subtype": "RoI field control", "role": "Substitutability of ICT TPP is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-38", "label": "Date of last audit for ICT services", "type": "control", "subtype": "RoI field control", "role": "Date of last audit for ICT services is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "roi-39", "label": "Exit plan existence", "type": "control", "subtype": "RoI field control", "role": "Exit plan existence is an entity-level RoI field control in the DORA RTS/ITS Pack." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://docs.servicenow.com/bundle/yokohama-governance-risk-compliance/page/product/grc-digital-operational-resilience/concept/digital-resilience-third-party-registers.html", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "vendor-servicenow", "label": "ServiceNow", "type": "vendor", "subtype": "DORA support vendor", "role": "ServiceNow is represented as the producer of a vendor-owned DORA support product." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://doraregister.io/", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "vendor-dapr", "label": "DAPR sp. z o.o.", "type": "vendor", "subtype": "DORA support vendor", "role": "DAPR sp. z o.o. is represented as the producer of a vendor-owned DORA support product." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://finray.tech/", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "vendor-finray-technologies-ltd", "label": "Finray Technologies Ltd", "type": "vendor", "subtype": "Finray product publisher", "role": "Finray Technologies Ltd is the publisher of Ordinis, included here only to satisfy product provenance for the recused Ordinis node." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://kpmg.com/xx/en/our-insights/regulatory-insights-financial-services/dora-digital-operational-resilience-act.html", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "vendor-kpmg-eu", "label": "KPMG (EU member firms)", "type": "vendor", "subtype": "DORA audit and advisory vendor", "role": "KPMG (EU member firms) is represented as public DORA advisory evidence for Article 28 RTS/ITS due-diligence questions." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://ordinis.io/", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "vendor-finray-technologies-ltd", "label": "Finray Technologies Ltd", "type": "vendor", "subtype": "Finray product publisher", "role": "Finray Technologies Ltd is the publisher of Ordinis, included here only to satisfy product provenance for the recused Ordinis node." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.bdo.com/insights/regulatory/dora-digital-operational-resilience-act", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "vendor-bdo-eu", "label": "BDO (EU member firms)", "type": "vendor", "subtype": "DORA audit and advisory vendor", "role": "BDO (EU member firms) is represented as public DORA advisory evidence for Article 28 RTS/ITS due-diligence questions." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.docusign.com/en-gb/solutions/industries/financial-services/dora", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "vendor-docusign", "label": "DocuSign", "type": "vendor", "subtype": "DORA support vendor", "role": "DocuSign is represented as the producer of a vendor-owned DORA support product." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.ey.com/en_gl/financial-services/dora-digital-operational-resilience-act", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "vendor-ey-eu", "label": "EY (EU member firms)", "type": "vendor", "subtype": "DORA audit and advisory vendor", "role": "EY (EU member firms) is represented as public DORA advisory evidence for Article 28 RTS/ITS due-diligence questions." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.forvismazars.com/group/en/services/financial-advisory/regulatory-compliance/dora", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "vendor-forvis-mazars-eu", "label": "Forvis Mazars (EU member firms)", "type": "vendor", "subtype": "DORA audit and advisory vendor", "role": "Forvis Mazars (EU member firms) is represented as public DORA advisory evidence for Article 28 RTS/ITS due-diligence questions." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.grantthornton.global/en/insights/articles/digital-operational-resilience-act-dora/", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "vendor-grant-thornton-eu", "label": "Grant Thornton (EU member firms)", "type": "vendor", "subtype": "DORA audit and advisory vendor", "role": "Grant Thornton (EU member firms) is represented as public DORA advisory evidence for Article 28 RTS/ITS due-diligence questions." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.processunity.com/dora-compliance-software/", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "vendor-processunity", "label": "ProcessUnity", "type": "vendor", "subtype": "DORA support vendor", "role": "ProcessUnity is represented as the producer of a vendor-owned DORA support product." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.pwc.com/gx/en/issues/cybersecurity/digital-operational-resilience-act.html", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "vendor-pwc-eu", "label": "PwC (EU member firms)", "type": "vendor", "subtype": "DORA audit and advisory vendor", "role": "PwC (EU member firms) is represented as public DORA advisory evidence for Article 28 RTS/ITS due-diligence questions." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.rsm.global/insights/digital-operational-resilience-act-dora", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "vendor-rsm-global", "label": "RSM Global", "type": "vendor", "subtype": "DORA audit and advisory vendor", "role": "RSM Global is represented as public DORA advisory evidence for Article 28 RTS/ITS due-diligence questions." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www2.deloitte.com/global/en/pages/risk/articles/dora-digital-operational-resilience-act.html", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "vendor-deloitte-eu", "label": "Deloitte (EU member firms)", "type": "vendor", "subtype": "DORA audit and advisory vendor", "role": "Deloitte (EU member firms) is represented as public DORA advisory evidence for Article 28 RTS/ITS due-diligence questions." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://docs.servicenow.com/bundle/yokohama-governance-risk-compliance/page/product/grc-digital-operational-resilience/concept/digital-resilience-third-party-registers.html", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "servicenow-digital-resilience-registers", "label": "ServiceNow Digital resilience third-party registers", "type": "product", "subtype": "vendor-owned DORA support product", "role": "ServiceNow Digital resilience third-party registers is vendor-owned evidence mapped only to supported DORA RTS/ITS controls." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://doraregister.io/", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "dapr-dora-register-solution", "label": "DORA Register of Information solution", "type": "product", "subtype": "vendor-owned DORA support product", "role": "DORA Register of Information solution is vendor-owned evidence mapped only to supported DORA RTS/ITS controls." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://ordinis.io/", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "prod-ordinis", "label": "Ordinis (recused)", "type": "product", "subtype": "product or service surface", "role": "Ordinis is a Finray Technologies Ltd compliance-operations product included as a recused vendor-universe entry." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.docusign.com/en-gb/solutions/industries/financial-services/dora", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "docusign-clm-dora-monitoring", "label": "DocuSign CLM / IAM for DORA agreement monitoring", "type": "product", "subtype": "vendor-owned DORA support product", "role": "DocuSign CLM / IAM for DORA agreement monitoring is vendor-owned evidence mapped only to supported DORA RTS/ITS controls." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.processunity.com/dora-compliance-software/", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "processunity-dora-compliance-software", "label": "ProcessUnity DORA compliance software", "type": "product", "subtype": "vendor-owned DORA support product", "role": "ProcessUnity DORA compliance software is vendor-owned evidence mapped only to supported DORA RTS/ITS controls." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://en.paperjam.lu/article/luxembourg-based-aws-receives-eu-critical-ict-designation-under-dora", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-amazon-web-services-emea-sarl", "label": "Amazon web Services EMEA Sarl", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "Amazon web Services EMEA Sarl appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-accenture-plc", "label": "Accenture plc", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "Accenture plc appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-amazon-web-services-emea-sarl", "label": "Amazon web Services EMEA Sarl", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "Amazon web Services EMEA Sarl appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-bloomberg-l-p", "label": "Bloomberg L.P.", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "Bloomberg L.P. appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-capgemini-se", "label": "Capgemini SE", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "Capgemini SE appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-colt-technology-services", "label": "Colt Technology Services", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "Colt Technology Services appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-deutsche-telekom-ag", "label": "Deutsche Telekom AG", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "Deutsche Telekom AG appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-equinix-emea-b-v", "label": "Equinix (EMEA) B.V.", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "Equinix (EMEA) B.V. appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-fidelity-national-information-services", "label": "Fidelity National Information Services, Inc.", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "Fidelity National Information Services, Inc. appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-google-cloud-emea-limited", "label": "Google Cloud EMEA Limited", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "Google Cloud EMEA Limited appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-international-business-machine-corporati", "label": "International Business Machine Corporation", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "International Business Machine Corporation appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-interxion-headquarters-b-v", "label": "InterXion HeadQuarters B.V.", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "InterXion HeadQuarters B.V. appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-kyndryl-inc", "label": "Kyndryl Inc.", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "Kyndryl Inc. appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-lseg-data-and-risk-limited", "label": "LSEG Data and Risk Limited", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "LSEG Data and Risk Limited appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-microsoft-ireland-operations-limited", "label": "Microsoft Ireland Operations Limited", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "Microsoft Ireland Operations Limited appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-ntt-data-inc", "label": "NTT DATA Inc.", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "NTT DATA Inc. appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-oracle-nederland-b-v", "label": "Oracle Nederland B.V.", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "Oracle Nederland B.V. appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-orange-sa", "label": "Orange SA", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "Orange SA appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-sap-se", "label": "SAP SE", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "SAP SE appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-tata-consultancy-services-limited", "label": "Tata Consultancy Services Limited", "type": "licensed-entity", "subtype": "CTPP-designated", "role": "Tata Consultancy Services Limited appears on the ESA Article 31(9) first-batch CTPP list; the ESA list does not state LEIs." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "eu-eea", "label": "European Union / European Economic Area", "type": "jurisdiction", "subtype": "EU/EEA", "role": "Jurisdiction perimeter for DORA Article 28 RTS/ITS and ESA Article 31(9) CTPP designation." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } }, { "primary_source_url": "https://www.eba.europa.eu/sites/default/files/2025-11/List%20of%20CTPPs%20published%20on%20the%20ESAs%20websites.pdf", "accessed_date": "2026-05-10", "finray_reviewed": true, "license": "CC-BY-4.0", "supports_node": { "id": "ctpp-designation", "label": "DORA Article 31(9) CTPP designation", "type": "status-class", "subtype": "CTPP designation class", "role": "Status class for first-batch critical ICT third-party providers designated under DORA Article 31(9)." }, "review_record": { "reviewer": "Finray Intelligence", "page": "https://finray.tech/intelligence/dora-rts-its-pack/", "graph": "https://finray.tech/intelligence/dora-rts-its-pack.json", "review_date": "2026-05-10" } } ], "generated_at": "2026-05-10T23:11:06.775Z" }