What changed in 2025
The Digital Operational Resilience Act applies to EU financial entities from January 2025 and sets out how they must manage ICT risk, including the risk from third-party providers. They must keep a register of every ICT provider, assess each before contracting, include specific clauses in every contract, and apply stricter rules where the provider supports a critical or important function. The questionnaire you receive is the assessment; the contract addendum that follows it is the clauses.
What a DORA questionnaire asks
Beyond the usual security questions, expect sections you may not have seen before:
- Your ICT risk management: how you identify, protect, detect, respond and recover, and who is accountable at management level.
- Incident reporting: your classification, your notification times, and whether you can support the customer's own reporting to its authority.
- Resilience testing: what testing you do, how often, and whether you would take part in the customer's threat-led penetration testing.
- Business continuity and exit: recovery objectives, tested continuity plans, and how the customer would exit or migrate away from your service, with what help and in what time.
- Sub-contracting: who your own providers are, where they are, and how you would tell the customer before changing them.
- Location: where data is processed and stored, and where the service is operated from.
- Audit and access rights: whether the customer, its auditors and its authority can inspect you, and how.
Answering as a vendor
Most rows are answered from the same library as any security questionnaire. The DORA-specific ones need a decision, not just a fact: what notification time you commit to, what exit assistance you provide, whether you accept audit rights and on what terms, and how much notice you give before changing a sub-processor. Decide these once, with whoever signs your contracts, write them down, and answer every DORA questionnaire from the same text. A vendor who answers those rows consistently across customers has an easier time at the contract stage, because the addendum then matches the questionnaire.
Evidence they will ask for
An assurance report on your controls (ISAE 3000, ISAE 3402 or SOC 2 Type II) shortens the review considerably and is often the difference between a questionnaire and an on-site audit. Continuity test results, the incident response plan and the sub-processor list are asked for almost every time. Keep them current with dates; DORA reviewers check dates. Responsemate keeps the evidence next to the answers with an expiry on each, and drafts the questionnaire rows from the decisions you wrote down once. How files and evidence are kept current.
Questions people ask
Does DORA apply to software vendors?
Not directly, unless you are designated a critical ICT third-party provider. But it applies to your financial customers, and it tells them in detail what they must know about you and what their contract with you must say. The questionnaire and the contract addendum are how they comply.
What is a critical or important function under DORA?
A function whose failure would materially impair the financial entity's performance, obligations or licence. If your service supports one, expect the longest questionnaire, exit plans, audit rights and a register entry with your details.