ICT third-party risk management Distinction vs. “outsourcing” under MaRisk/MaGo DORA introduces ICT third-party risk management as a separate but parallel regime to sectoral outsourcing law. Key differences: Implication: you get a two-dimensional matrix: …and both regimes must be satisfied in parallel. Widening of contractual requirements DORA massively extends the minimum mandatory contract clauses for ICT services. 1. Formal requirements 2. Minimum content for all ICT contracts (Art. 30(2) DORA) Among others: 3. Additional clauses where critical/important functions are supported (Art. 30(3) DORA, RTS TPPol Art. 8–9) Examples (all explicitly listed in the Annex table): 4. Implementation impact New rules on subcontracting Subcontracting of ICT services … Continue reading ICT third-party risk managementRead More →