Are we a DORA financial entity, or an ICT third-party service provider to one?
| Status | Basis | What to do |
|---|---|---|
| EU financial entity (including a subsidiary set up in the EU) | Listed in Article 2(1) | ICT risk management framework, major incident classification and reporting, resilience testing, third-party risk management and the register of information |
| ICT third-party service provider | Provides ICT services to such financial entities | Meet the Article 30 contract clauses, supply register information, support incident handling and testing, prepare exit arrangements |
| Designated critical ICT third-party service provider | Designated by the European Supervisory Authorities under Article 31; the first 19 were named on 18 November 2025, none from Taiwan | Direct oversight by a lead overseer |
One group can hold both roles; decide entity by entity.
What evidence should the CISO prepare for the contract clauses clients require under Article 30?
Article 30 requires financial entities to put the following into contracts: a description of the service, where services are provided and data processed, assistance with ICT incidents, cooperation with authorities and termination rights; for critical or important functions, also service levels, business continuity plans and testing, audit rights and an exit strategy.
Evidence the CISO can prepare:
- A list of service and data processing locations
- Incident handling and notification procedures
- Business continuity plans and test records
- Arrangements and a contact for audits
The client must also record your service in its register of information (templates in Implementing Regulation (EU) 2024/2956; providers outside the EU are identified by LEI). Have legal counsel review contractual liability.
What are the deadlines for reporting a major ICT incident, and how far must an ICT provider support them?
Under Article 19 of DORA and Article 5 of Delegated Regulation (EU) 2025/301, the financial entity reports:
| Stage | Deadline |
|---|---|
| Initial notification | Within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it |
| Intermediate report | Within 72 hours of the initial notification |
| Final report | Within one month of the latest intermediate report |
Whether an incident is major is decided under Delegated Regulation (EU) 2024/1772. The provider should agree in advance with the client who supplies what information and by when, so the client can file the initial notification within 4 hours, and write that into its own response procedure.
Our EU financial subsidiary also meets the NIS2 criteria. Do we report incidents twice?
For financial entities that are also essential or important entities under NIS2, DORA is a sector-specific act within the meaning of Article 4 of NIS2 (DORA Article 1(2)). Under recital 28 of NIS2 and Commission guidelines C/2023/6068, member states should not apply NIS2's risk management, reporting, supervision and enforcement provisions to those financial entities, which follow DORA instead; NIS2's national cyber crisis management framework (Article 9) and EU-CyCLONe (Article 16) still apply.
Group members or ICT providers that are not DORA financial entities may still fall under NIS2 in their own right. In the incident classification step, the CISO decides entity by entity whether DORA or NIS2 applies.
Can a Taiwanese ICT provider be fined directly under DORA? How should the exposure be explained to the board?
Generally not. Providers not designated as critical ICT third-party service providers have no direct DORA obligations; requirements reach them through client contracts and the register of information, and penalties for financial entities are set by each member state under Article 50. Only for designated critical providers can the lead overseer impose periodic penalty payments under Article 35: daily, for up to 6 months, up to 1% of average daily worldwide turnover in the previous business year.
The often-quoted "2% of global annual turnover" is the NIS2 Article 34 rule for essential entities and does not apply to DORA financial entities. In the board report, present the exposure as contractual liability, assessed by legal counsel against the contracts.
Clients want us to support resilience testing, TLPT and exit strategy. How does the CISO prepare?
- Annual testing: confirm which of your systems the client's testing covers and schedule it into your own testing and maintenance plans.
- TLPT: confirm whether threat-led penetration testing applies and how you will support it; feed results back into risk management.
- Exit strategy: write down in advance, as an executable arrangement, how data and services move on termination or transfer and how long the transition lasts.
If you do not serve EU financial entities, or a client only asks for a security questionnaire and no DORA contract clauses, the records of your existing ISO 27001 system are usually enough.
How does Winners Consulting help a CISO with DORA?
- Status: determine whether you are a financial entity or an ICT provider, confirm the scope of contractual obligations and how ready you are for the register of information.
- Gap analysis: build the documentation chapter by chapter against DORA, including an incident reporting SOP for initial notification within 4 hours of classifying an incident as major.
- Third-party risk: set up a supplier risk assessment method, the required contract clauses (audit rights, data portability, exit strategy) and register maintenance.
- Testing: TLPT applicability assessment and test planning, plus a combined DORA and NIS2 assessment.
- One body of evidence: organisations with ISO 27001 or business continuity management reuse existing documents and controls.
- Division of roles: VP- and director-level consultants lead the work end to end, never outsourced.
Read more: DORA consulting, choosing a DORA consultant, NIS2, ISO 22301. Apply for a free mechanism diagnosis
How other roles see this service
Other services for this role
- CISO implementing ISO 27001: board reporting, the ESG bonus point and certification scope
- CISO on ISO 27701 and GDPR: cross-border data, employee data and the 72-hour notice
- CISO facing NIS2: are we in scope, and how to handle several EU countries, the board and reporting?
- CISO facing the EU CRA: who leads, 24-hour reporting, SBOM and budget
- CISO implementing ISO/IEC 29147: reporting channel, CVD policy and CRA reporting
- CISO guide to ISO/IEC 30111: linking vulnerability handling to CRA reporting
- CISO guide to IEC 62443: which parts to pursue and how it relates to the EU CRA
- CISO guide to TISAX: assessment level, ISA2027 and timeline
- CISO guide to ISO/SAE 21434: product security beyond TISAX
- CISO guide to ISO 22301: ICT recovery, RTO and exercises
- CISO guide to ISO 42001: what AI governance shares with ISO 27001
- CISO and the EU AI Act: what do AI security, logs and human oversight require?
- CISO and trade secret protection: designing classification and access logs that hold up
Official sources
- Regulation (EU) 2022/2554 DORA (EUR-Lex)
- Delegated Regulation (EU) 2025/301：DORA 重大 ICT 事件通報（EUR-Lex）
- Commission Delegated Regulation (EU) 2024/1772: classification of major ICT-related incidents (EUR-Lex)
- Commission Implementing Regulation (EU) 2024/2956: register of information templates (EUR-Lex)
- ESAs: designation of critical ICT third-party providers (18 November 2025)
- Commission Guidelines on Article 4(1) and (2) of NIS2, C/2023/6068 (EUR-Lex)