Topic starter
11/07/2026 8:46 pm
TL;DR: DORA makes financial entities accountable for ICT third-party risk across extended networks, with unified requirements for risk management, auditability, and incident reporting ahead of January 2025, according to OneTrust. The practical shift is that resilience governance now depends on inventory, lifecycle oversight, and evidence-ready controls rather than periodic vendor checks.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “Navigating the Digital Operational Resilience Act (DORA) With OneTrust”.
By the numbers:
- DORA is the first regulation to oversee the security functions of financial entities across the European Union, covering 21 distinct types of financial entities.
- DORA goes into force in January 2025.
Key questions
Q: What breaks when third-party risk is treated as a periodic review under DORA?
A: Periodic review fails because DORA expects continuous accountability across the full ICT dependency chain, including downstream providers and lifecycle changes.
Q: When should financial teams prioritise DORA evidence over more questionnaires?
A: They should prioritise evidence as soon as the programme needs to prove control effectiveness, not just collect responses.
Q: Where does third-party governance fail in practice under DORA?
A: It fails when organisations stop at direct vendors and ignore the operational dependencies beneath them.
Practitioner guidance
- Build a complete ICT third-party inventory Map every provider that supports critical or important functions, including downstream dependencies, and assign clear owners for each relationship.
- Connect access governance to third-party records Link vendor access, service accounts, delegated admin paths, and entitlement reviews to the third-party register so evidence is traceable.
- Set lifecycle triggers for evidence collection Trigger due diligence updates, risk re-assessments, and offboarding checks when relationship scope, access, or services change.
Bottom line: DORA reframes third-party oversight as a financial resilience requirement that extends across downstream service relationships.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:13 pm
DORA is really a governance reset for extended enterprise risk. The article shows that financial entities can no longer treat third-party oversight as a periodic review exercise. Once fourth parties and Nth parties are in scope, the control problem becomes lifecycle visibility across relationships, access paths, and evidence trails. Practitioners should treat third-party governance as part of resilience architecture, not an adjacent compliance task.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Which regulatory controls matter most for DORA-ready resilience programmes?
A: The controls that matter most are the ones that make risk decisions provable: documented policies, mapped controls, audited evidence, and repeatable lifecycle reviews. DORA is not satisfied by intent alone. Teams need a governance stack that can show how third-party risk is identified, monitored, escalated, and reviewed across the full service chain.
👉 Read our full editorial: Dora compliance shifts third-party risk into financial resilience governance