European Supervisory Authorities announce timeline and reporting approach for CTPP designation under DORA (registers of information)

The European Supervisory Authorities (ESAs) communicated the timeline and reporting approach for the designation of critical ICT third-party service providers (CTPPs) under DORA, supported by an ESA Decision and associated data model for the DORA register of information. This affects vendor cybersecurity & data privacy by operationalizing supervisory oversight of ICT vendors serving EU financial entities and by driving standardized collection/reporting of ICT third-party contractual and service information (via competent authorities and regulated entities’ registers of information). Vendors supporting EU financial entities should anticipate increased information requests, structured data expectations, and governance requirements tied to DORA third-party risk oversight.