ICT Third-Party Risk
Controlling Third-Party Risks
From contracts and service chains to exit strategies.
Objective
- Systematically identify, assess and manage ICT third-party risks.
- Contractual requirements, SLA framework and exit strategies for all critical service providers.
- Continuous monitoring and risk-based review of service provider performance.
- Integration with DORA Chapter V and MaRisk AT 9 (Outsourcing Management).
Contractual Requirements
Standardized minimum requirements for all ICT third-party contracts with institution-specific supplements for critical service providers.
Due Diligence
Risk-based assessment of potential service providers prior to contract conclusion focusing on information security, financial stability and business continuity.
SLA Framework
Uniform service level framework with defined availability, response and reporting requirements.
Audit Rights
Contractually secured audit, control and instruction rights as well as access to audit reports and certifications.
Exit Strategies
Documented exit scenarios with data transfer, migration and deletion for each critical service provider relationship.
Concentration Risk
Detection and management of cluster risks from dependency on individual service providers or geographic clusters.
Information Register
Complete recording of all ICT third-party relationships in the information register with assignment to regulated activities.
Strategic Goals
- Complete transparency over all ICT third-party relationships and their risk profiles.
- Uniform contractual requirements with minimum standards for security, availability and reporting.
- Risk-based management with differentiated control and monitoring intensities.
- Ensure exit capability for every critical service provider relationship.
- Identify and address concentration risks at an early stage.
- Audit-proof documentation and evidence management for regulators and auditors.
- Continuous improvement of service provider management based on incidents and findings.
SLA Framework
The standardized SLA framework defines minimum requirements for all ICT third-party service providers:
Availability
Minimum availability, maintenance windows and outage compensation.
Response Times
Defined response and resolution times by priority.
Reporting
Regular status reports, KPI dashboards and incident documentation.
Penalties
Contractual penalties and escalation mechanisms for SLA violations.
Monitoring & Control
Continuous monitoring of service provider performance and risk development:
Operational Monitoring
Ongoing monitoring of KPIs, availability, incidents and changes.
Risk-Based Monitoring
In-depth reviews for critical service providers or after incidents.
Reporting Cycles
Monthly status reports, quarterly review meetings, annual audits.
Automation
Automated KPI collection and alerting when thresholds are exceeded.
Note:
These contents are implementation aids based on DORA Chapter V (Art. 28–30), MaRisk AT 9 and EBA guidelines. They do not replace legal advice or binding supervisory interpretation.