DORA Third-Party Cloud Risk Management: A Technical Guide for Financial Institutions

Cloud infrastructure is now deeply integrated into financial technology environments.

Banks, payment institutions, insurance companies, and investment firms use cloud platforms for application hosting, databases, transaction processing, data storage, monitoring, and infrastructure services.

From an engineering perspective, this creates distributed technology dependencies.

A financial application may rely on a cloud hosting provider, an identity service, an external database platform, and several subcontracted technology components. A failure affecting one dependency could influence multiple services.

DORA addresses these challenges through its ICT risk management and third-party risk management requirements.

1. Understanding DORA's ICT Third-Party Risk Framework

The Digital Operational Resilience Act has applied since 17 January 2025.

Article 28 requires financial entities to manage ICT third-party risks as part of their overall ICT risk management framework.

An important distinction is that outsourcing does not transfer regulatory responsibility.

Even when a cloud provider manages infrastructure, the financial entity remains responsible for ensuring that its DORA obligations are addressed.

2. Map Cloud Dependencies

Before evaluating cloud risks, organizations need a clear understanding of their technology dependencies.

A typical cloud-dependent financial service may involve:

• Application hosting infrastructure.
• Database and storage services.
• Authentication and identity platforms.
• API gateways and integrations.
• Monitoring and logging services.
• Backup and disaster recovery services.
• External security and support providers.

Dependency mapping helps identify which services support critical or important functions.

It also helps organizations understand whether several business applications rely on the same underlying provider.

3. Assess Service Criticality

Not every cloud service creates the same operational risk.

A cloud application supporting an internal administrative activity may have a different risk profile from infrastructure supporting payment processing or customer access.

Financial entities should evaluate:

• Business impact if the service becomes unavailable.
• Information sensitivity.
• Recovery requirements.
• Availability expectations.
• Provider substitutability.
• Dependencies on other technology services.

This helps determine the level of monitoring and contractual protection required.

4. Understand the Register of Information

DORA requires financial entities to maintain a Register of Information covering contractual arrangements with ICT third-party service providers.

For technology and risk teams, maintaining this register requires reliable information about providers, services, contractual relationships, and relevant dependencies.

The information should remain accurate when services, providers, or contracts change.

This creates an important connection between procurement, legal, security, architecture, and ICT risk management teams.

5. Evaluate Cloud Contracts Under Article 30

DORA Article 30 establishes contractual requirements for ICT services.

For services supporting critical or important functions, agreements should address matters including:

• Service descriptions and service levels.
• Security and availability obligations.
• Data processing and storage locations.
• Subcontracting arrangements.
• Access and audit rights.
• Cooperation with competent authorities.
• Business continuity arrangements.
• Termination and transition requirements.

Engineering teams should be able to connect these contractual requirements with the actual technical architecture and provider capabilities.

For example, contractual data-location commitments should be understood alongside the cloud service's deployment and processing arrangements.

6. Manage Subcontracting and Supply Chain Dependencies

Cloud platforms are rarely built around one organization alone.

Providers may depend on infrastructure partners, software vendors, data centres, network operators, and specialist service providers.

These relationships can introduce additional risks.

Financial institutions should evaluate relevant subcontracting arrangements, particularly when services support critical or important functions.

The European Commission's Delegated Regulation (EU) 2025/532 provides additional requirements concerning the assessment of subcontracting arrangements for such services.

7. Monitor Provider Concentration Risk

A common architecture decision is to consolidate services within a single cloud ecosystem.

Although this may simplify management, it can increase dependency on one provider.

Organizations should identify:

• Shared infrastructure dependencies.
• Services relying on the same provider.
• Potential single points of failure.
• Migration constraints.
• Alternative service options.

Multi-cloud architecture is not automatically a solution. It can introduce additional complexity, security challenges, and integration costs. The organization's actual risk assessment should guide the decision.

8. Design Practical Exit Strategies

A cloud exit strategy needs technical detail.

Organizations should consider:

• Data export capabilities.
• Application portability.
• Infrastructure configuration dependencies.
• Database compatibility.
• API and integration changes.
• Identity and access migration.
• Backup restoration.
• Migration testing.
• Business continuity during transition.

A provider exit plan should be evaluated against realistic recovery and operational requirements.

9. Connect Engineering With Governance

DORA compliance is not only a legal or procurement responsibility.

Engineering teams understand the technical dependencies. Security teams evaluate vulnerabilities and controls. Procurement manages provider relationships. Legal teams review contractual arrangements. Senior management maintains governance responsibilities.

These teams need to work together to ensure that technical reality, contractual commitments, and risk assessments remain aligned.

Conclusion

DORA third-party cloud risk management requires financial institutions to understand and continuously monitor their technology dependencies.

Dependency mapping, service criticality assessments, supplier oversight, contractual controls, concentration risk analysis, and practical exit strategies are important components of this process.