Checklist: assessing a critical ICT vendor under NIS2 Art. 21, DORA Arts. 28-30 and GDPR Art. 28

Regulatory references

DORA applies to financial entities. Its contractual provisions are nonetheless a useful reference for any organisation assessing a critical vendor.

1. Security governance and organisation

• Is there an information security officer with a defined mandate?
• Are security policies approved and reviewed at a stated frequency?
• Do staff with access to customer data receive security training and have confidentiality obligations?
• Does the vendor in turn assess its own critical suppliers?

2. Certifications and attestations

• ISO/IEC 27001 certificate: certification body, accreditation, expiry. Does the certificate scope include the service being purchased?
• Statement of Applicability available on request, at least for the controls relevant to the service?
• SOC 2 report: Type 1 or Type 2, period covered, criteria included, exceptions noted by the auditor.
• Complementary user entity controls listed in the report and subservice organisations carved out of scope.
• If the period covered ended some time ago, is a bridge letter available?

3. Access and identity

• Who at the vendor can access customer data or systems, and through what authorisation process?
• Is MFA mandatory for administrative and remote access?
• Periodic review of privileged access and prompt revocation when staff leave?
• Is administrative access logged, with logs retained for a defined period?
• Does the service support single sign-on and customer-managed user administration?

4. Data location and sub-processors

• In which countries or regions are data processed and stored, including backups and support?
• List of sub-processors handling customer data, with role and location.
• How, and with what notice, does the vendor communicate changes of location or sub-processors?
• For transfers outside the European Economic Area, which GDPR mechanism is used?
• Encryption at rest and in transit; who manages the keys?

5. Incident notification to customers

• Within what time does the vendor notify the customer of an incident affecting it? Is that time compatible with the NIS2 24 hours and with the customer's DORA and GDPR timelines?
• What information does the first communication contain, and who is the contact?
• Does the vendor notify personal data breaches without undue delay, as GDPR Article 33(2) requires of processors?
• Does the vendor cooperate in the analysis and provide a root cause report?

6. Business continuity and backup

• Are there tested continuity and disaster recovery plans for the service, with the date of the last test?
• Are recovery objectives (time and maximum data loss) stated for the service?
• Backup frequency, retention, separation and restore testing.
• Service levels with measured availability and periodic reports.

7. Vulnerability management

• Remediation times for vulnerabilities by severity level.
• Independent penetration tests: frequency and availability of a summary of results.
• Secure development procedures and checks on third-party dependencies (NIS2 Art. 21(3)).
• Is there a vulnerability disclosure policy with a reporting channel?

8. Exit and termination

• Return of data in an easily accessible format and certified deletion at the end of the contract.
• Transition assistance to another vendor or in-house, with a defined transition period.
• Termination rights and minimum notice periods.
• Does the customer have a documented exit strategy, including a workable alternative?

DORA Article 30: clauses to check in the contract

For all ICT service contracts, Article 30(2) requires among other things:

• a clear and complete description of functions and services, with the conditions for any subcontracting;
• the locations where services are provided and data are processed and stored, with a duty to give advance notice of changes;
• provisions on availability, authenticity, integrity and confidentiality of data;
• access, recovery and return of data in the event of the provider's insolvency, resolution or discontinuation of business, or termination of the contract;
• service level descriptions;
• assistance in the event of an ICT incident related to the service, at no additional cost or at a cost determined ex ante;
• full cooperation with competent and resolution authorities;
• termination rights and minimum notice periods;
• conditions for participation in the entity's ICT security awareness and digital operational resilience training programmes.

DORA Article 30(3): additionally for critical or important functions

• Service levels with precise quantitative and qualitative performance targets.
• Notice periods and reporting obligations of the provider on developments that may affect the service.
• A duty to implement and test contingency plans and to have appropriate ICT security measures.
• Participation and cooperation in the entity's threat-led penetration testing (TLPT).
• Unrestricted rights of access, inspection and audit.
• Exit strategies with an adequate transition period.

GDPR Article 28: minimum content of the processor contract

• Processing only on documented instructions from the controller, including for transfers.
• Confidentiality obligations for persons authorised to process the data.
• Security measures under Article 32.
• Engagement of sub-processors only with specific or general written authorisation, and with the same obligations.
• Assistance to the controller with data subject rights and with the obligations in Articles 32-36.
• Deletion or return of data at the end of the service.
• Provision of the information needed to demonstrate compliance, and allowance for audits and inspections.

How to use the answers

• The depth of the assessment follows the vendor's criticality: not every vendor needs every question.
• An answer without evidence (certificate, report, contract extract) should be recorded as a statement, not as a verification.
• Negative answers become risks with an owner: a clause to negotiate, a compensating measure or a justified acceptance.
• The assessment should be repeated when certifications expire, at contract renewal and after an incident or a significant change to the service.

In EVIDEVO

In Vendor management, contracts, supported functions, assessments and clauses are linked to the data in the register of information required by DORA Article 28. Certifications and reports received are recorded as evidence with a validity date; negative answers are linked to risks in Risk management.