--- title: "DORA: contracts" url: "https://support.3rdrisk.com/en/article/dora-contracts" language: "en" last_updated: "2026-08-20T15:57:38.382Z" --- # DORA: contracts Put a contract in DORA scope and complete the fields the Register of Information needs. The Register of Information reports contractual arrangements, not just providers. Putting a third party in DORA scope is only half the job: the contract for those ICT services has its own scope setting, and its own set of fields. ## **Overview** Navigate to: Left menu: **Third-parties**, then **Contracts**. Like the catalogue, the contracts list has a **Digital Operational Resilience Act (DORA)** tab that shows only the contracts in scope. It is the quickest way to see what the register currently contains. ![](https://cdn-assets.productfruits.com/46c673b2-af56-4759-8d37-64414013195a) *Note: putting a third party in DORA scope does* ***not*** *put its contracts in scope. They are separate settings, and a provider with no contract in scope contributes almost nothing to the register.* ## **1\. Put a contract in DORA scope** - Open the contract from the list and **click** on **Edit contract**. - In **This contractual arrangement falls under**, choose **Digital Operational Resilience Act (DORA)**. - Fill in the DORA fields that appear. - **Click** on **Save**. ![](https://cdn-assets.productfruits.com/2d9eb7d5-c0d3-400a-a08a-96c5d858ee7e) Once it is in scope, the header carries a **DORA** badge — one for the contract, and one for the third party it belongs to — and the DORA fields on the form are marked with a small indicator. *Note:* ***This contractual arrangement falls under*** *accepts more than one regulation. If your platform also has EBA switched on, the same contract can fall under DORA and EBA at once, and each field carries a marker for every regulation that asks for it.* Learn more: [European Banking Authority (EBA)](https://support.3rdrisk.com/en/article/european-banking-authority-eba) *Note: the contract opens read-only.* ***Edit contract*** *in the bottom right puts it into edit mode.* ## **2\. The fields the register needs** **On the contract itself** | Field | What it is | | --- | --- | | **Type of contractual arrangement** | Standalone, overarching, or a subsequent arrangement | | **Intra-group contract** | Whether the provider is inside your own group | | **Subcontractors** | Other third parties that deliver part of the service — see below | | **Function identifier** | The business function this contract supports, picked from your organisation model | | **Entity signing the contractual arrangement for receiving** | The entity in your group that signed | | **Entity signing the contractual arrangement for providing** | The providing entity | | **Start date** and **end date** | | | **Last review date** | | **About the service** | Field | What it is | | --- | --- | | **Type of ICT services** | What is delivered | | **Country where the services are provided** | | | **Annual expense or estimated cost** | | | **Storage of data** | Whether data is stored, and where it sits at rest | **About the risk** | Field | What it is | | --- | --- | | **Level of reliance** | How much you depend on this arrangement | | **Substitutability of the ICT provider** | How replaceable the provider is | | **Possibility of reintegration** | Whether the service could be brought back in-house | | **Impact of discontinuing the ICT services** | | | **Notice period for the ICT service provider** | | | **Notice period for the financial entity** | | Some fields open up others. Choosing a substitutability of **not substitutable** or **highly complex** makes the **reliance dependence reason** required. Choosing a **subsequent or associated** arrangement asks for the reference number of the overarching arrangement it sits under. *Note: the function identifier is what ties a contract to a business function, and the function is what carries the criticality judgement. A contract with no function attached leaves that link empty in the register.* ## **3\. Subcontractors** DORA asks you to report the chain, not just the party you signed with. If your provider has someone else deliver part of the service, that shows up in the register as a second link in the supply chain. In the platform a subcontractor is **a third party in your own catalogue**, linked to the contract in the **Subcontractors** field. So before you can add one, it has to exist as a third party. - Make sure the subcontractor exists in **Third-parties → Catalogue**, with an identification code. - Open the contract and **click** on **Edit contract**. - Add it under **Subcontractors**. - Optionally give it its own **type of ICT services** — if you leave that empty, it inherits the contract's. ![](https://cdn-assets.productfruits.com/2d9eb7d5-c0d3-400a-a08a-96c5d858ee7e) *Above:* ***Subcontractors*** *on the contract, holding one linked third party with its reference —* ***Example Logistics B.V. · THP-185****.* ### **What it produces** ![](https://cdn-assets.productfruits.com/12d3cb94-fecd-404f-a474-8261476bd140) Take a contract with **DILIGENT SERVICES** as the provider, and one subcontractor, **Example Logistics B.V.**, that delivers part of the service. The supply-chain table of the register then contains two rows for that one contract: | Rank | ICT third-party service provider | Recipient of the sub-contracted services | | --- | --- | --- | | 1 | DILIGENT SERVICES | DILIGENT SERVICES | | 2 | Example Logistics B.V. | DILIGENT SERVICES | Read the second row as: *Example Logistics delivers to DILIGENT SERVICES, which delivers to you.* Both rows carry the same contract reference, so the supervisor can see they belong to one arrangement. A subcontractor also appears in its own right in the list of ICT third-party providers, alongside the parties you contracted with directly. It is listed once, even if several contracts name it. *Note: adding a subcontractor does not create a contract. It records that a party is part of the chain under an existing arrangement — there is no second contract to fill in.* ## **4\. Check your work** The health check validates every contract in DORA scope and reports which fields are still missing, per contract. Learn more: [DORA: health check and Register of Information export](https://support.3rdrisk.com/en/article/dora-health-check-and-register-of-information-export) ## **Permissions needed** **Permissions needed:** the permissions you already use to view and edit contracts. No separate DORA permission exists. ## **Known limitations** - **Scope is per contract.** A third party in scope does not bring its contracts with it. - **The DORA fields sit on the contract form, not on a tab of their own** — they are marked with an indicator next to the label. - **The providing entity can only be one of your own organisation elements.** For an arrangement with an external provider there is no external option, even though the field is required for every contract in scope. - **The contract opens read-only**, which is easy to mistake for fields being locked. Use **Edit contract**. - **The supply chain goes two levels deep.** A subcontractor is always reported at rank 2, so a subcontractor of a subcontractor cannot be expressed. - **On the rank 1 row the provider and the recipient columns hold the same code.** That is what the export currently writes for a direct arrangement. - **On the rank 2 row the two "type of code" columns are filled from the opposite party** to the code they describe. If a supervisor queries those two cells, that is why.