The DORA register of information, without starting from the spreadsheet
By HodeitekPublished
If you are the CISO of a financial entity and you are asked for the DORA register of information without a third-party engineering team, this guide gives you the order of work and what to decide before opening any template.
What exactly you are asked for
DORA is Regulation (EU) 2022/2554 and it has applied since 17 January 2025. Its Article 28(3) requires the financial entity to maintain and update a register of information on all contractual arrangements for the use of ICT services provided by third-party providers.
The format is not improvised: Commission Implementing Regulation (EU) 2024/2956 sets the standard templates of the register. There are 15 templates, which is why the register is best treated as a data set and not as a document.
Where to start on a Monday
Before filling in anything, order what you already have. Four decisions avoid most of the rework.
- List every contract where a third party provides an ICT service, not only the technology ones: the payroll provider or the document-custody provider too.
- Decide who owns each contract. Without an owner, nobody updates the data.
- Note each provider's LEI and jurisdiction. These fields are repeated across several templates.
- Record in the same place whether an exit plan and an audit right exist, two of the clauses Article 30 asks for in contracts.
What the clause check looks like
Three invented providers, to show what data is asked per contract. They are not real entities nor any customer's data.
| Provider | Service | Exit plan | Audit right |
|---|---|---|---|
| Provider A | Cloud hosting | Yes | Yes |
| Provider B | Payment gateway | Yes | No |
| Provider C | Document custody | No | No |
What HodeiShield does and what it does not
HodeiShield keeps suppliers, contracts and concentration in one register and can generate the register of information as an xBRL-CSV package with the structure of the 15 templates. It records LEI and jurisdiction per provider and tracks the exit plan and the audit right of Article 30.
This is a partial capability: the exporter is still being completed. It does not file anything with the supervisor and does not replace legal review. Filing through the official channel stays with the entity.
Sources
See the register with your own suppliers
In a demo we walk through the ICT provider register, the clauses and the sample package with sample data. A person at Hodeitek answers you.