The Digital Operational Resilience Act (DORA) sets one EU-wide rulebook for how financial entities manage ICT risk. Banks, payment and e-money institutions, investment firms, insurers, crypto-asset service providers and other in-scope entities in Greece and Cyprus are supervised against it by their national competent authorities, such as the Bank of Greece, the Hellenic Capital Market Commission, the Central Bank of Cyprus and CySEC.
One of DORA's most demanding areas is ICT third-party risk. Most financial entities depend on cloud providers, software vendors, data processors and managed service providers, and DORA makes the financial entity responsible for understanding and managing the risk those suppliers introduce.
What DORA requires for ICT third parties
- A strategy and policy for ICT third-party risk, approved and reviewed by the management body.
- Risk assessment and due diligence before entering a contract with an ICT supplier.
- Minimum contract terms, with stronger requirements where the service supports critical or important functions.
- A register of information covering all contractual arrangements with ICT third-party service providers, available to the supervisor.
- Exit strategies for services supporting critical or important functions.
- Ongoing monitoring of the supplier's performance and risk throughout the relationship.
Why questionnaires alone are not enough
Annual security questionnaires are self-reported, slow and quickly out of date. A supplier can answer well in January and expose an unpatched system in March. DORA's emphasis on ongoing monitoring means financial entities need evidence that is refreshed far more often than a yearly review cycle.
Outside-in monitoring addresses part of that gap. It observes a supplier's internet-facing systems — exposed services, software versions, email security, web encryption and similar signals — without needing access to the supplier's internal network. It does not replace contracts, audits or questionnaires, but it shows where to ask harder questions.
A practical approach for Greek and Cypriot financial entities
- Inventory every ICT supplier and flag those supporting critical or important functions.
- Complete the register of information and keep it current as contracts change.
- Tier suppliers by criticality and apply deeper due diligence to the top tier.
- Add continuous outside-in monitoring for the suppliers that matter most, with alerts when their risk changes.
- Record findings, supplier responses and remediation so the evidence is ready for supervisors and internal audit.
How Infocredit Group helps
Infocredit Group offers RiskRecon by Mastercard in Greece and Cyprus to monitor suppliers' internet-facing cyber risk continuously, with local support from our teams in Nicosia and Athens. Combined with our company data and due diligence services, it helps compliance, risk and IT teams build a documented, repeatable supplier oversight process.
This guide is general information, not legal advice. Confirm your specific obligations with your supervisor or legal adviser.
Frequently asked questions
Does DORA apply in Greece and Cyprus?
Yes. DORA is an EU regulation, so it applies directly in every member state, including Greece and Cyprus, from 17 January 2025.
What is the DORA register of information?
A record, maintained by each financial entity, of all its contractual arrangements with ICT third-party service providers. Supervisors can request it, and it must distinguish services that support critical or important functions.
Is DORA the same as NIS2?
No. DORA is the specific ICT resilience rulebook for the EU financial sector; NIS2 covers cybersecurity for a broader set of essential and important entities. Both put weight on supply-chain security.
Can outside-in monitoring prove DORA compliance?
No single tool proves compliance. Outside-in monitoring provides ongoing evidence about suppliers' internet-facing security, which supports the monitoring part of your third-party risk framework.
Compliance insights, straight to your inbox
Monthly analysis on AML, screening and risk technology from the teams behind ComplianceSuite, RISQO and API4ALL. No spam — unsubscribe anytime.