[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:dora\u002F28":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"dora","28","Article 28","General principles on ICT third-party risk",0,"Regulation (EU) 2022\u002F2554 (Digital Operational Resilience Act)","**What it asks for.** Article 28 requires financial entities to manage ICT third party risk as an integral part of ICT risk management. They remain fully responsible for compliance when using ICT providers, must maintain a register of information on all contractual arrangements, assess risks before contracting and have exit strategies for services supporting critical or important functions.\n\n**In practice.** The entity keeps a complete register of ICT contracts, performs due diligence and concentration risk assessment before contracting, includes required contractual provisions, monitors providers and tests exit plans. A strategy on ICT third party risk is approved by the management body. Evidence includes the register, due diligence files, contracts and exit plans.\n\n**Common gaps.** Registers are often incomplete, especially for intragroup and subcontracted services. Exit strategies are written but not realistic or tested.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022R2554#art_28","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]