Chapter V - Managing ICT Third-Party Risk

The Digital Operational Resilience Act (EU) 2022/2554, Chapter V sets out requirements for financial entities to identify, assess and monitor risks arising from third-party information-and-communication-technology (ICT) providers. It mandates contractual safeguards, ongoing oversight, and contingency planning to ensure that outsourced ICT services do not compromise the institution's operational resilience.