If you are a Compliance Officer or Operational Resilience Lead at a European transport operator designated as a critical entity, this playbook was built for you.
As a critical transport operator under the scope of the Digital Operational Resilience Act (DORA), you face mounting pressure to establish robust governance over third-party ICT providers that support essential services. Regulatory scrutiny is intensifying around contractual enforceability, audit rights, exit planning, and incident reporting timelines. You must demonstrate due diligence in selecting and monitoring ICT third parties, ensure resilience testing is conducted regularly, and maintain evidence of compliance across multiple overlapping frameworks. Failure to meet Article 22, 26 obligations exposes your organization to direct supervision, reputational damage, and significant administrative fines.
Engaging external consultants to design a compliant third-party risk program typically costs between EUR 80,000 and EUR 250,000 depending on provider scope and jurisdiction. Alternatively, dedicating internal resources requires at least 3 full-time compliance and risk professionals working for 4 to 6 months to research requirements, draft policies, build assessment tools, and align controls across DORA, NIS2, and ISO standards. This comprehensive playbook delivers the same outcome at a fraction of the cost, just $395.
What you get
| Phase | File Type | Description | Count |
| 1. Risk Identification | Domain Assessment Workbooks | Structured 30-question assessment per domain covering DORA-mandated risk factors including provider concentration, access controls, data sovereignty, and resilience capabilities | 7 |
| 2. Evidence Collection | Evidence Runbook | Step-by-step guide listing required documentation from third parties: audit reports, security certifications, business continuity plans, subcontractor disclosures, and incident logs | 1 |
| 3. Contractual Compliance | Contract Clause Library | Pre-drafted legal clauses for inclusion in ICT service agreements covering audit rights, data protection, incident notification timelines, exit assistance, and subcontractor oversight | 1 |
| 4. Monitoring & Reporting | Incident Reporting Template | Standardized form aligned with DORA Article 24 for reporting major ICT-related incidents to national competent authorities within 24 hours of identification | 1 |
| 5. Resilience Testing | Testing Protocol Guide | Methodology for conducting annual resilience testing of critical third parties, including test scoping, scenario design, execution checklists, and reporting formats | 1 |
| 6. Governance & Oversight | RACI Matrix Template | Role-based responsibility assignment chart defining accountability across legal, procurement, IT, security, and compliance teams for third-party risk activities | 1 |
| 6. Governance & Oversight | Work Breakdown Structure (WBS) | Hierarchical task list breaking down third-party risk management into executable work packages with estimated effort and dependencies | 1 |
| 7. Audit Readiness | Audit Preparation Playbook | Checklist-driven guide to prepare for supervisory reviews under DORA, including document indexing, gap remediation tracking, and mock audit workflows | 1 |
| Cross-Cutting | Cross-Framework Mappings | Detailed alignment tables linking DORA requirements to NIS2, ISO/IEC 27001, and ISO/IEC 22301 control objectives | 1 |
| Cross-Cutting | Implementation Roadmap | 12-week rollout plan with milestones, stakeholder touchpoints, and deliverables for deploying the full third-party risk program | 1 |
| Total Files Included | 64 | ||
Domain assessments
Each of the seven domain assessments contains 30 targeted questions designed to evaluate third-party risk exposure across key operational and technical dimensions required under DORA Article 22, 23:
- Provider Criticality & Concentration Risk: Assesses the extent to which an ICT provider supports essential functions and the potential impact of service disruption due to market concentration.
- Data Protection & Sovereignty: Evaluates compliance with EU data residency laws, encryption standards, and cross-border data transfer mechanisms.
- Access Controls & Identity Management: Reviews authentication protocols, privilege management, and separation of duties within the third party's systems.
- Resilience & Business Continuity: Validates the existence and adequacy of disaster recovery plans, backup frequency, failover capabilities, and RTO/RPO alignment.
- Security Operations: Examines threat detection, vulnerability management, patch cycles, and security event logging practices.
- Subcontractor Oversight: Determines transparency into tier-two providers, contractual flow-down requirements, and monitoring mechanisms.
- Incident Response & Reporting: Tests the third party's ability to detect, escalate, and report major ICT incidents within DORA-mandated timeframes.
What this saves you
| Activity | Time Required Without Playbook | Time Required With Playbook | Estimated Hours Saved |
| Developing third-party risk assessment criteria | 120 hours | 4 hours (adaptation) | 116 |
| Drafting audit-ready contract clauses | 80 hours | 6 hours (review and integration) | 74 |
| Building evidence collection process | 100 hours | 8 hours (customization) | 92 |
| Creating incident reporting templates | 40 hours | 2 hours (formatting) | 38 |
| Designing resilience testing protocols | 60 hours | 5 hours (scenario tailoring) | 55 |
| Preparing for regulatory audit | 140 hours | 20 hours (gap closure) | 120 |
| Establishing governance roles (RACI/WBS) | 50 hours | 4 hours (role mapping) | 46 |
| Total Estimated Time Saved | 441 hours | ||
Who this is for
- Compliance Officers responsible for implementing DORA requirements in transport organizations classified as critical entities
- Operational Resilience Managers overseeing third-party dependencies in ICT service delivery
- Information Security Leads tasked with assessing vendor security posture and integration with internal controls
- Legal and Contract Managers who must draft and negotiate ICT service agreements with enforceable audit and exit clauses
- Risk Management Teams conducting due diligence on high-impact third-party providers
- Internal Audit Units preparing for supervisory examinations under DORA and NIS2
- Chief Information Officers needing structured oversight tools for ICT supply chain governance
Cross-framework mappings
The playbook includes full alignment between DORA Article 22, 26 and the following regulatory and standards frameworks:
- DORA (Regulation (EU) 2022/2554) , Articles 22, 23, 24, 25, 26
- NIS2 Directive (Directive (EU) 2022/2555) , Articles 21, 22, 23
- ISO/IEC 27001:2022 , Controls related to supplier relationships, information security in ICT services, and third-party risk assessment
- ISO/IEC 22301:2019 , Requirements for business continuity in outsourced critical activities
What is NOT in this product
- This playbook does not include legal advice or attorney-client privileged materials
- It does not contain pre-filled templates with your organization's data or third-party information
- No software, SaaS platform, or automated workflow tool is provided
- The product does not cover non-ICT third parties such as physical maintenance vendors or catering services
- It is not a certification body service or official audit opinion
- Training sessions, webinars, or consulting hours are not included
- Country-specific legal interpretations or national implementation nuances are not addressed beyond EU-level requirements
Lifetime access and satisfaction guarantee
You receive lifetime access to the DORA ICT Third-Party Risk Management Playbook with no subscription fee and no login portal required. The files are delivered as downloadable PDFs and editable templates. There is no recurring charge. We include a 30-day money-back guarantee: If this playbook does not save your team at least 100 hours of manual compliance work, email us for a full refund. No questions, no friction.
About the seller
