Third Party. First Priority.
Why Your Partners Might Be the Weakest Link: Why Every Board Needs a Hard Reset on Third-Party Risk.
Despite their abundance, ICT risk frameworks create confusion rather than clarity for financial institutions. This becomes even more apparent with the Digital Operational Resilience Act (DORA), which introduces new third-party risk requirements.
My goal? Cut through this confusion. After analyzing 12+ frameworks across four categories, I'll show you where they overlap with DORA's third-party requirements and where critical gaps remain. I'll organize these frameworks to ensure complete coverage without overlap.
European Regulatory Frameworks: Strong on Governance, Light on Technical Controls
European frameworks naturally align with DORA's regulatory approach to ICT risk. The EBA ICT Guidelines establish governance structures that mirror DORA's board accountability requirements and provide risk assessment methodologies that satisfy DORA's identification demands.
ESMA's Cloud Guidelines address outsourcing risks but focus primarily on contractual safeguards rather than technical verification methods.
EIOPA's framework adds insurance-specific considerations but shares similar limitations.
These European frameworks align with DORA's governance requirements but fall short of technical validation and continuous monitoring expectations.
International Standards: Technical Depth but Integration Challenges
ISO 27001/27002 provides comprehensive security controls, including those related to supplier relationships (ISO 27002:2022 Section 5.19), but lacks specificity for the financial sector.
The NIST CSF offers a structured approach to third-party risk management through its "Supply Chain Risk Management" category; however, it requires significant customization for the financial services sector.
COBIT 2019 excels at governance and risk alignment, but its broad scope makes implementation complex. ITIL 4 supports DORA's third-party management processes as one of the four dimensions and 34 management practices but lacks depth in risk assessment.
These frameworks provide the technical depth DORA requires but need integration work to meet financial sector needs.
Operational Resilience Frameworks: Strong on Continuity, Weak on Prevention
The BCBS Principles emphasize operational resilience but provide limited guidance on preventative third-party controls. They focus on recovery rather than prevention.
ISO 22301 provides robust business continuity processes, but it treats third-party risk as just one element rather than a central concern.
ENISA's Good Practices for Supply Chain Cybersecurity provide EU-specific guidance but lack the comprehensive approach that the DORA demands.
These frameworks support DORA's incident response and resilience requirements but underdeliver on preventative controls.
Supply Chain Frameworks: Closest Alignment but Implementation Gaps
NIST 800-161 provides the most comprehensive approach to third-party risk management, closely aligning with DORA's requirements. However, its U.S. government origins require adaptation to EU financial contexts.
ISO 27036 offers solid guidance on supplier security but lacks specificity for the financial sector. The EBA Outsourcing Guidelines provide relevant context but need technical enhancement to meet DORA's requirements.
These frameworks align most closely with DORA's third-party risk requirements but still leave implementation gaps.
Key Overlaps with DORA's Third-Party Requirements
Risk assessment methodologies: All frameworks emphasize risk-based approaches, aligning with DORA's requirement to assess third parties based on criticality.
Contractual safeguards: European frameworks (EBA, ESMA, EIOPA) and ISO 27036 provide contractual templates that satisfy many DORA requirements.
Incident response: BCBS Principles and ISO 22301 provide incident management processes compatible with DORA's notification requirements.
Governance structures: COBIT and the European frameworks establish governance models that support DORA's oversight requirements.
Exit strategies: The EBA Outsourcing Guidelines and NIST 800-161 address exit planning and support DORA's substitutability requirements.
Critical Gaps Requiring Attention
Technical validation: DORA requires technical validation of third-party controls; however, most frameworks focus on contractual assurances rather than actual verification.
Concentration risk: Few frameworks address the systemic concentration risk among critical third parties, a key concern of DORA.
Continuous monitoring: DORA requires ongoing monitoring of third-party risks, whereas most frameworks focus on point-in-time assessments.
Digital operational resilience testing: DORA's testing requirements exceed those recommended by most frameworks, particularly for critical third parties.
Regulatory oversight: unlike existing frameworks, DORA introduces direct Oversight of critical ICT third-party providers.
Practical Implementation Strategy
You need a hybrid approach. Begin with NIST 800-161 as your technical foundation, incorporate the EBA Outsourcing Guidelines for financial context, and supplement with ISO 22301 for resilience planning.
This combination addresses most DORA requirements while minimizing implementation complexity. The remaining gaps require custom solutions:
Develop technical validation procedures beyond contractual reviews
Implement continuous monitoring capabilities for critical providers
Create concentration risk assessment methodologies
Design comprehensive resilience testing programs
Prepare for regulatory Oversight of critical providers
The Path Forward
DORA represents a paradigm shift in third-party risk management. Existing frameworks provide valuable building blocks but not a complete solution.
Financial institutions must move beyond checkbox compliance to true resilience, meaning:
Treating third-party risk as a board-level concern
Building technical validation capabilities
Implementing continuous monitoring solutions
Developing concentration risk mitigation strategies
Creating comprehensive resilience testing programs
Thriving institutions will view DORA not as a compliance burden but as an opportunity to strengthen their operational resilience.
Frameworks provide guidance, not solutions. The real work lies in adapting them to your needs and filling the gaps with practical, tailored approaches.
DORA's third-party requirements may seem daunting, but with a strategic approach to framework integration, you can transform compliance challenges into resilience advantages.