ict-third-party-register
Use this when the register is first built, at each periodic refresh, and whenever an ICT contract is signed, changed or ended. You get four files in a new folder, ./ict-third-party-register/: a spreadsheet you can open in Excel listing every ICT contract with its provider, the business functions it supports, data locations, subcontractors and exit plan, and where each fact came from (register.csv); a list of missing fields, missing exit plans and contracts for legal review (gaps.md); a one-page view of the providers that several critical functions depend on (concentration.md); and one block of questions per function owner (questions-for-owners.md). This skill drafts for a human to review and sign; this skill never marks a control effective. The working register is not the regulatory submission; the entity's own team prepares and files that.
Inputs to gather
Read the contract repository, the supplier list or tiering, the accounts payable export, the list of the entity's business functions with any existing criticality assessment, the group structure, any existing outsourcing register, and the ICT asset inventory. Ask the reader, in one message: which legal entities of the group are in scope, which functions the entity has already classed as critical or important, who owns each function, and when the next submission to the competent authority is due.
Step 1: build the population of ICT arrangements
DORA Art. 28(3) asks financial entities to keep a register of information on all contractual arrangements for ICT services, to report on new arrangements to the competent authority at least yearly, and to hand over the full register on request. DORA has applied since 17 January 2025, so this is a standing deliverable: a stale register is a finding in itself. Read "ICT service" widely: cloud and hosting, software and software as a service, data and market data feeds, managed security and network services, support and maintenance, and services from other companies in the same group. Intra-group providers and click-through online terms are the arrangements most often missed. One row per contractual arrangement, not per supplier: a provider with three contracts is three rows linked to one provider.
Step 2: map arrangements to functions
For each arrangement, list the business functions it supports. Propose, with one line of reasoning, whether each function is critical or important, using the entity's own assessment where it exists. The classification is the entity's decision; the agent proposes and flags disagreements with an existing assessment. Where a provider supports a critical or important function, trace the chain of subcontractors that effectively underpin the service, as far as the contract and the provider's documents show. Where the contract is silent on whether and under which conditions the service may be subcontracted, that silence is a contract gap for legal review (Art. 30(2)(a)), not just an unknown.
Step 3: collect the fields
For each arrangement collect: the contract reference, start, end and notice terms; the provider's legal entity and identifier (a legal entity identifier where one exists); the service type; the functions supported; data involved and storage and processing locations; the subcontractors in the chain; how easily the service could be substituted; whether an exit plan exists and was tested; the date of the last risk assessment. The exact template, field list and codes come from the implementing technical standards and change over time; run a framework lookup for the current version rather than assuming the columns.