The DORA regulation requires financial entities to significantly strengthen third-party management, particularly regarding security and operational resilience. However, contrary to popular belief, evaluating your third parties does not mean evaluating them directly against the DORA framework.
Understanding What DORA Requires (and What It Doesn’t)
Following a cross-analysis (conducted in January 2025) of the DORA regulation, EU Delegated Regulation 2024/1773, and the Final Report JC 2023 86 draft, Tenacy conducted an in-depth keyword-based search (e.g., prestataire, third party, must, commits, etc.) to identify all direct and indirect obligations related to third-party providers.
Result: 32 obligations were identified and linked in Tenacy to existing measures. This set forms a minimum baseline for any third-party evaluation within the context of DORA compliance.
🔎 If your organization is subject to DORA and you need to evaluate your third parties, your assessments should at a minimum cover these topics (measures):
⚠️ This interpretation does not constitute legal advice. It should be adapted to your contractual context in consultation with your legal department.
Which Frameworks Should Be Used for Assessments?
DORA does not provide a specific evaluation framework but does mandate certain thematic areas. That’s why Tenacy has mapped the identified measures to standard frameworks available in our catalog.
The two most relevant frameworks today are:
ISO 27002:2013 – covers 95% of DORA-related measures
NIST CSF – covers 91% of DORA-related measures
These frameworks enable you to meet DORA requirements without duplicating efforts or creating hard-to-maintain custom frameworks.
What This Means for Your Third-Party Evaluations
This work helps clarify a key point:
💡Being compliant with DORA means your evaluations should cover the topics mandated by DORA — not that you must build a DORA-specific framework for each provider.
In practice, this means:
Categorizing your suppliers by criticality level to adjust the scope of your assessments
Using appropriate frameworks based on criticality (e.g., ISO 27002, NIST CSF, etc.)
A Practical Approach: Categorization in Tenacy
In Tenacy, we recommend structuring your third parties directly in the Organization module, using criticality groups that match your internal policy. For example, based on the CESIN model:
Criticality Group C1: Critical or essential providers (e.g., hosting, telecom, cloud services)
Criticality Group C2: Important but non-critical providers (e.g., maintenance, non-essential SaaS tools)
Criticality Group C3: Non-sensitive providers (e.g., logistics, general services)
This categorization allows you to trigger targeted assessments based on risk level.
💡See this article for more information on modeling your organization in Tenacy.
Putting It into Practice in Tenacy
To manage your third parties in line with DORA, you can follow this methodology within Tenacy:
Categorize your third parties in Organization (C1, C2, C3…)
Associate an appropriate evaluation framework based on criticality
Check for DORA coverage using the measures already mapped by Tenacy (see visual)
Document and trace your evaluations to demonstrate compliance.
🔎 For any questions about implementing this approach in your Tenacy space, don’t hesitate to contact your Customer Success Manager.