For financial entities assessing build infrastructure
DORA and ICT third-party risk in CI
DORA applies from January 2025 and treats ICT third-party providers as a register-able, exit-planned dependency. That includes your CI platform.
Regulation (EU) 2022/2554 — DORA — applies to financial entities from 17 January 2025. Among other things it requires maintaining a register of information on ICT third-party service providers, contractual provisions covering ICT services, and documented exit strategies.
Why CI usually shows up late
CI platforms tend to be procured by engineering rather than through vendor management, so they often are not on the register when the first review happens. A platform with production deployment credentials is not a marginal dependency.
What you will need from us
| DORA expectation | What we provide |
|---|---|
| Register of information entries | Entity details, locations, sub-processors, service description |
| Data location | Six EU regions, pinned per runner group |
| Subcontracting transparency | Published sub-processor list, 30 days' notice of change |
| Incident reporting | Contractual notification terms and a public status page |
| Audit and access rights | Contractual audit rights; SOC 2 Type 2 under NDA |
| Exit strategy | One-line reversal, documented on every migration page |
Sources
- Regulation (EU) 2022/2554 (DORA) — https://eur-lex.europa.eu/eli/reg/2022/2554/oj
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.