The requirements set out in the outsourcing rules and in DORA show many similarities. Both the outsourcing rules and DORA set requirements for arrangements with third-party service providers.
This document provides a comparison of the ESMA Guidelines on outsourcing to cloud service providers, the EBA Guidelines on outsourcing arrangements and the Digital Operational Resilience Act (DORA), in the context of the relationship with third-party service providers. One difference to highlight is that the obligations in DORA focus on all digital and data services provided on an ongoing (i.e. not one-off) basis via ICT systems and are not limited to ICT services that qualify as outsourcing. The outsourcing rules pertain to all outsourcing arrangements, whether or not these are ICT-related.
Would you like to receive this overview? Please contact Max Mohrmann.