{"id":70839,"date":"2026-10-07T09:02:54","date_gmt":"2026-10-07T07:02:54","guid":{"rendered":"https:\/\/swissgrc.com\/en\/?p=70839"},"modified":"2026-10-07T09:32:24","modified_gmt":"2026-10-07T07:32:24","slug":"dora-cloud-provider-supervisory-object","status":"publish","type":"post","link":"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/","title":{"rendered":"When does a cloud provider become a supervised entity under DORA?"},"content":{"rendered":"<div id=\"sgce-a\" class=\"sgce-article\">\n<p class=\"rc-lede\">Since 17 January 2025, Regulation (EU) 2022\/2554, known as DORA, has applied directly to almost all supervised financial entities in the EU. On 18 November 2025, EBA, ESMA and EIOPA designated the first 19 critical ICT third-party providers, including major cloud and technology providers. This makes the previously abstract oversight framework concrete: financial entities must not only know which of their providers have been classified as critical, but also systematically keep track of their own contracts, risks and dependencies. Structured <strong>Third-Party Risk Management (TPRM)<\/strong> is therefore becoming an important part of DORA implementation.<\/p>\n<div class=\"rc-tldr\">\n<div class=\"rc-tldr-label\">In brief<\/div>\n<p>Since the ESAs designated the first 19 critical ICT third-party providers on 18 November 2025, these providers have been subject to a Lead Overseer with extensive examination and information-gathering powers. However, financial entities remain responsible for their own obligations: under Articles 28 and 30 DORA, they must continue to embed due diligence, concentration risk assessments, audit and access rights, and binding exit strategies in their contracts and processes. This further increases the importance of systematic Third-Party Risk Management.<\/p>\n<\/div>\n<nav class=\"rc-toc\" aria-label=\"Contents\">\n<div class=\"rc-toc-label\">Contents<\/div>\n<ol>\n<li><a href=\"#a1-was-aendert-die-liste-vom-18-november-20\">What does the list of 18 November 2025 change in practice?<\/a><\/li>\n<li><a href=\"#a2-wie-laeuft-die-aufsicht-durch-den-lead-o\">How does oversight by the Lead Overseer work?<\/a><\/li>\n<li><a href=\"#a3-welche-vertraglichen-pflichten-bleiben-b\">Which contractual obligations remain with financial entities?<\/a><\/li>\n<li><a href=\"#a4-was-geschieht-wenn-ein-anbieter-empfehlu\">What happens if a provider does not implement recommendations?<\/a><\/li>\n<li><a href=\"#a5-was-folgt-daraus-fuer-schweizer-institut\">What does this mean for Swiss institutions?<\/a><\/li>\n<\/ol>\n<\/nav>\n<h2 id=\"a1-was-aendert-die-liste-vom-18-november-20\">What does the list of 18 November 2025 change in practice?<\/h2>\n<p>For the first time, the list names the ICT third-party providers classified as critical and subject to direct oversight by a European supervisory authority. The first 19 designated critical ICT third-party providers cover various technology areas, including cloud computing, data centres, telecommunications, managed services and other ICT services.<\/p>\n<p>In the <a href=\"https:\/\/legal.pwc.de\/en\/news\/articles\/esas-publish-first-list-of-critical-ict-third-party-providers-under-dora\" target=\"_blank\" rel=\"noopener nofollow\">first list of critical ICT third-party providers<\/a> published on 18 November 2025, EBA, ESMA and EIOPA designated 19 providers as critical. They include Amazon Web Services EMEA Sarl, Google Cloud EMEA Limited, IBM, Accenture, Capgemini, Deutsche Telekom and Bloomberg, among others. The designation was based on the criteria set out in DORA.<\/p>\n<p>For the affected providers, the designation means direct European oversight. However, this does not change the financial entities\u2019 own responsibility for managing their ICT third-party providers. They must continue to assess which providers support critical or important functions, what dependencies and concentration risks exist, and whether their contracts meet regulatory requirements.<\/p>\n<p>This is precisely where structured <strong>Third-Party Risk Management (TPRM)<\/strong> comes in: critical providers, dependencies, risks, contractual requirements and their ongoing monitoring should be centrally recorded and managed in a transparent and traceable way.<\/p>\n<figure class=\"rc-shot\">\n<img src=\"https:\/\/swissgrc.com\/wp-content\/uploads\/2025\/04\/Isometric-screenshots-net-background-1024x572.png\" alt=\"TPRM software\" loading=\"lazy\" decoding=\"async\"><figcaption>Views from the TPRM module of the SwissGRC platform: risk dashboard, service catalogue and criticality assessment<\/figcaption><\/figure>\n<h2 id=\"a2-wie-laeuft-die-aufsicht-durch-den-lead-o\">How does oversight by the Lead Overseer work?<\/h2>\n<p>Depending on the sector, EBA, EIOPA or ESMA assumes the role of Lead Overseer for each designated provider and coordinates the oversight.<\/p>\n<p>The Lead Overseer is supported by Joint Examination Teams made up of staff from the European supervisory authorities and relevant competent authorities. These teams conduct risk-based examinations and assess, among other things under Article 33 DORA, whether a provider has effective structures for ICT risk management, incident handling, security and subcontracting.<\/p>\n<p>The <a href=\"https:\/\/www.esma.europa.eu\/node\/221305\" target=\"_blank\" rel=\"noopener nofollow\">guide on oversight activities<\/a>, published by the European supervisory authorities on 15 July 2025, describes the process from designation through risk assessment and examination to the follow-up of recommendations. Oversight includes, among other things, information requests, investigations and on-site inspections.<\/p>\n<p>For financial entities, this development means one thing above all: direct oversight of a critical provider does not replace their own Third-Party Risk Management. Companies must still be able to understand which providers support their critical functions, what risks arise from these dependencies, and how those risks are monitored and managed. Centralising provider information, criticality, dependencies and measures creates the transparency needed for this.<\/p>\n<h2 id=\"a3-welche-vertraglichen-pflichten-bleiben-b\">Which contractual obligations remain with financial entities?<\/h2>\n<p>Before entering into a contract, financial entities must continue to assess themselves whether a function is critical or important, what concentration risk arises and whether the provider passes the required due diligence.<\/p>\n<p>Under Article 28 DORA, before entering into a contractual arrangement, it must be assessed whether it concerns a critical or important function, ICT concentration risk under Article 29 must be evaluated, and <a href=\"https:\/\/swissgrc.com\/keine-auslagerung-war-bisher-das-ende-der-pruefung-jetzt-ist-es-der-anfang\/\">due diligence of the provider<\/a> must be carried out. For contracts concerning critical or important functions, Article 30 DORA requires, among other things, appropriate access, inspection and audit rights for the financial entity, appointed third parties and competent authorities.<\/p>\n<p>Article 30 DORA also requires an exit strategy that enables an orderly transition. These <a href=\"https:\/\/swissgrc.com\/nis2-lieferkette-governance-vertragspflicht\/\">minimum contractual requirements<\/a> apply regardless of whether a provider is on the list of critical ICT third-party providers. However, their practical relevance continues to increase as critical ICT dependencies become more important.<\/p>\n<p>For companies, this means that contract management and Third-Party Risk Management should not be viewed in isolation. Criticality, risks, contractual requirements and exit strategies should form part of an end-to-end process that remains traceable throughout the entire provider lifecycle.<\/p>\n<h2 id=\"a4-was-geschieht-wenn-ein-anbieter-empfehlu\">What happens if a provider does not implement recommendations?<\/h2>\n<p>If a critical provider does not implement the recommendations of the Lead Overseer, the relevant national supervisory authority may, under the conditions set out in Article 42 DORA, require the affected financial entity to suspend or terminate its relationship with the provider.<\/p>\n<p>This makes one point clear: even though direct examinations focus on the critical ICT third-party provider, the financial entity remains responsible for managing its own ICT risks. The costs of European oversight, however, are borne by the critical ICT third-party providers.<\/p>\n<p>For financial entities, maintaining an up-to-date overview of critical providers, their risk profiles, contract status, dependencies and supervisory findings is therefore essential. Only this enables changes to be identified early and necessary measures to be managed in a transparent and traceable way.<\/p>\n<h2 id=\"a5-was-folgt-daraus-fuer-schweizer-institut\">What does this mean for Swiss institutions?<\/h2>\n<p>DORA does not generally apply directly to Swiss financial entities as Swiss regulation. The European framework becomes particularly relevant where business activities, EU branches or contractual relationships with EU-regulated financial entities and their providers are affected. For the national regulation of Swiss institutions, FINMA Circular 2023\/01 \u201cOperational risks\u201d, or the applicable FINMA regulatory framework, remains decisive.<\/p>\n<p>In practice, DORA can nevertheless have an impact through cross-border business relationships and contractual requirements. Swiss institutions should therefore not only assess whether DORA applies directly to them, but also analyse which requirements are effectively passed on to them by customers, business partners or providers.<\/p>\n<p>A practical first step is to compare your own provider inventory with the list of the 19 designated critical ICT third-party providers. Next, assess which critical or important functions are supported by these providers, what dependencies and concentration risks exist, and whether existing contracts cover the relevant requirements under Articles 28 and 30 DORA. This information should be documented centrally and updated regularly so that changes in providers and risks can be identified at an early stage.<\/p>\n<div class=\"rc-bridge\">\n<div class=\"rc-bridge-mark\"><\/div>\n<div>\n<div class=\"rc-bridge-label\">Related<\/div>\n<h3>Manage Third-Party Risk and Operational Resilience centrally<\/h3>\n<p>The SwissGRC platform helps companies systematically map critical functions, provider dependencies and risks. With Third-Party Risk Management and Operational Resilience, risks, contractual requirements and measures can be centrally monitored and managed transparently throughout the entire provider lifecycle.<\/p>\n<p><a href=\"https:\/\/swissgrc.com\/operational-resilience-software\/\">Operational Resilience <span class=\"rc-pfeil\" aria-hidden=\"true\"><\/span><\/a>\n<\/div>\n<\/div>\n<aside class=\"rc-takeaways\">\n<div class=\"rc-takeaways-label\">For practical implementation<\/div>\n<h2>Key takeaways<\/h2>\n<ul>\n<li>Compare your provider inventory with the list of the 19 designated critical ICT third-party providers published on 18 November 2025.<\/li>\n<li>Identify critical and important functions as well as the resulting dependencies and concentration risks.<\/li>\n<li>Review existing contracts for relevant requirements under Articles 28 and 30 DORA, particularly audit, access and exit rights.<\/li>\n<li>Monitor recommendations issued by the responsible Lead Overseer to your providers, as failure to implement them may have consequences for your institution.<\/li>\n<li>As a Swiss institution, assess to what extent DORA becomes relevant to your organisation through EU branches, business partners or contractual requirements.<\/li>\n<\/ul>\n<\/aside>\n<section class=\"rc-faq\">\n<div class=\"rc-faq-head\">\n<div class=\"rc-faq-label\">FAQ<\/div>\n<h2>Frequently asked questions<\/h2>\n<\/div>\n<div class=\"rc-faq-list\">\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Which providers have been on the DORA list of critical ICT third-party providers since November 2025?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>On 18 November 2025, EBA, ESMA and EIOPA designated the first 19 providers as critical. They include major cloud and technology providers, among others. The list is published and updated by the European supervisory authorities.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What is a Lead Overseer under DORA?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Depending on the financial sector, the Lead Overseer is EBA, ESMA or EIOPA and assumes direct oversight of a designated critical ICT third-party provider. Supported by Joint Examination Teams, it conducts risk assessments and supervisory examinations and follows up on recommendations issued to providers.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Do financial entities still need to conduct their own contract reviews despite EU oversight of cloud providers?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Yes. The designation changes oversight of the provider, but not the financial entity\u2019s own responsibility. Under Articles 28 and 30 DORA, due diligence, concentration risk assessment and appropriate audit, access and exit rights remain relevant, among other requirements.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What happens if a critical ICT provider does not implement the Lead Overseer\u2019s recommendations?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Under the conditions set out in Article 42 DORA, the relevant national supervisory authority may require the affected financial entity to suspend or terminate its relationship with a provider. The financial entity\u2019s own responsibility for managing its ICT risks therefore remains unchanged.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Does DORA also apply to Swiss banks?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>DORA does not generally apply directly to Swiss institutions. However, the European legal framework may become relevant, particularly through EU branches, cross-border business relationships and contractual requirements. Swiss institutions should therefore assess which direct and indirect points of contact with DORA exist.<\/p>\n<\/div>\n<\/details>\n<\/div>\n<\/section>\n<section class=\"rc-sources\">\n<div class=\"rc-sources-label\">Sources<\/div>\n<ol>\n<li><a href=\"https:\/\/legal.pwc.de\/en\/news\/articles\/esas-publish-first-list-of-critical-ict-third-party-providers-under-dora\" target=\"_blank\" rel=\"noopener nofollow\">First list of critical ICT third-party providers<\/a><span class=\"rc-source-pub\">PwC Legal<\/span><\/li>\n<li><a href=\"https:\/\/www.esma.europa.eu\/node\/221305\" target=\"_blank\" rel=\"noopener nofollow\">Guide on DORA oversight of critical third-party providers activities<\/a><span class=\"rc-source-pub\">ESMA<\/span><\/li>\n<\/ol>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Since the ESAs designated 19 critical ICT third-party providers for the first time on 18 November 2025, these providers are subject to a Lead Overseer with examination and information rights. Financial entities remain responsible themselves: under Articles 28 and 30 DORA they must continue to anchor due diligence assessments, concentration risk assessments, audit and access rights, and binding exit strategies in their contracts.<\/p>\n","protected":false},"author":5,"featured_media":70840,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_eb_attr":"","_swissgrc_real_author":"Gentian Ajeti","real_author_title":"Chief Customer & Commercial Officer","real_author_bio":"Follows customer projects from initial rollout through everyday use, gaining a close view of where a platform actually creates value. This vantage point on profitability and partner collaboration shapes how he approaches sales and customer relationships at Swiss GRC.","real_author_photo":70094,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[105],"tags":[226,227,223,224,225],"class_list":["post-70839","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-regulation-supervision","tag-dora-outsourcing-financial-entities","tag-finma-circular-2023-01","tag-ict-third-party-provider-list","tag-lead-overseer-dora","tag-article-28-and-30-dora"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"19 critical ICT third-party providers are now under EU oversight. Read which obligations financial entities still bear themselves under DORA.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"superadmin\"\/>\n\t<meta name=\"google-site-verification\" content=\"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_GB\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Swiss GRC | Governance, Risk &amp; Compliance (GRC)\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"DORA: What the List of Critical ICT Providers Means\" \/>\n\t\t<meta property=\"og:description\" content=\"19 critical ICT third-party providers are now under EU oversight. Read which obligations financial entities still bear themselves under DORA.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/dora-cloud-provider-supervisory-object-swissgrc.webp\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/dora-cloud-provider-supervisory-object-swissgrc.webp\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-07T07:02:54+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-07T07:32:24+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:title\" content=\"DORA: What the List of Critical ICT Providers Means\" \/>\n\t\t<meta name=\"twitter:description\" content=\"19 critical ICT third-party providers are now under EU oversight. Read which obligations financial entities still bear themselves under DORA.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/dora-cloud-provider-supervisory-object-swissgrc.webp\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"superadmin\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/dora-cloud-provider-supervisory-object\\\/#blogposting\",\"name\":\"DORA: What the List of Critical ICT Providers Means\",\"headline\":\"When does a cloud provider become a supervised entity under DORA?\",\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2026\\\/10\\\/dora-cloud-provider-supervisory-object-swissgrc.webp\",\"width\":1200,\"height\":630,\"caption\":\"Swiss GRC article image showing the logo and an abstract control grid graphic in mint, category DORA im Betrieb\"},\"datePublished\":\"2026-10-07T09:02:54+02:00\",\"dateModified\":\"2026-10-07T09:32:24+02:00\",\"inLanguage\":\"en-GB\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/dora-cloud-provider-supervisory-object\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/dora-cloud-provider-supervisory-object\\\/#webpage\"},\"articleSection\":\"Regulation &amp; Supervision, DORA outsourcing financial entities, FINMA Circular 2023\\\/01, ICT third-party provider list, Lead Overseer DORA, Article 28 and 30 DORA\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/dora-cloud-provider-supervisory-object\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/#listItem\",\"position\":2,\"name\":\"Regulation &amp; Supervision\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/dora-cloud-provider-supervisory-object\\\/#listItem\",\"name\":\"When does a cloud provider become a supervised entity under DORA?\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/dora-cloud-provider-supervisory-object\\\/#listItem\",\"position\":3,\"name\":\"When does a cloud provider become a supervised entity under DORA?\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\",\"name\":\"Swiss GRC AG\",\"description\":\"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"telephone\":\"+41412207500\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/Logo_V1_Original_mit_Claim.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/dora-cloud-provider-supervisory-object\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/dora-cloud-provider-supervisory-object\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.twitter.com\\\/SwissGRC\",\"https:\\\/\\\/www.instagram.com\\\/swissgrc\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCy4QuXYekCQrA4n5oEwJSJg\",\"https:\\\/\\\/ch.linkedin.com\\\/company\\\/swissgrc\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/\",\"name\":\"superadmin\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/dora-cloud-provider-supervisory-object\\\/#authorImage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/01\\\/logo-red.svg\",\"width\":96,\"height\":96,\"caption\":\"superadmin\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/dora-cloud-provider-supervisory-object\\\/#webpage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/dora-cloud-provider-supervisory-object\\\/\",\"name\":\"DORA: What the List of Critical ICT Providers Means\",\"description\":\"19 critical ICT third-party providers are now under EU oversight. Read which obligations financial entities still bear themselves under DORA.\",\"inLanguage\":\"en-GB\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/dora-cloud-provider-supervisory-object\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2026\\\/10\\\/dora-cloud-provider-supervisory-object-swissgrc.webp\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/dora-cloud-provider-supervisory-object\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"Swiss GRC article image showing the logo and an abstract control grid graphic in mint, category DORA im Betrieb\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/dora-cloud-provider-supervisory-object\\\/#mainImage\"},\"datePublished\":\"2026-10-07T09:02:54+02:00\",\"dateModified\":\"2026-10-07T09:32:24+02:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"name\":\"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM\",\"description\":\"Governance, Risk & Compliance (GRC)\",\"inLanguage\":\"en-GB\",\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>DORA: What the List of Critical ICT Providers Means<\/title>\n\n","aioseo_head_json":{"title":"DORA: What the List of Critical ICT Providers Means","description":"19 critical ICT third-party providers are now under EU oversight. Read which obligations financial entities still bear themselves under DORA.","canonical_url":"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/#blogposting","name":"DORA: What the List of Critical ICT Providers Means","headline":"When does a cloud provider become a supervised entity under DORA?","author":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"publisher":{"@id":"https:\/\/swissgrc.com\/en\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/dora-cloud-provider-supervisory-object-swissgrc.webp","width":1200,"height":630,"caption":"Swiss GRC article image showing the logo and an abstract control grid graphic in mint, category DORA im Betrieb"},"datePublished":"2026-10-07T09:02:54+02:00","dateModified":"2026-10-07T09:32:24+02:00","inLanguage":"en-GB","mainEntityOfPage":{"@id":"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/#webpage"},"isPartOf":{"@id":"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/#webpage"},"articleSection":"Regulation &amp; Supervision, DORA outsourcing financial entities, FINMA Circular 2023\/01, ICT third-party provider list, Lead Overseer DORA, Article 28 and 30 DORA"},{"@type":"BreadcrumbList","@id":"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/swissgrc.com\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/#listItem","position":2,"name":"Regulation &amp; Supervision","item":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/#listItem","name":"When does a cloud provider become a supervised entity under DORA?"},"previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/#listItem","position":3,"name":"When does a cloud provider become a supervised entity under DORA?","previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}}]},{"@type":"Organization","@id":"https:\/\/swissgrc.com\/en\/#organization","name":"Swiss GRC AG","description":"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.","url":"https:\/\/swissgrc.com\/en\/","telephone":"+41412207500","logo":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/06\/Logo_V1_Original_mit_Claim.png","@id":"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/#organizationLogo"},"image":{"@id":"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/#organizationLogo"},"sameAs":["https:\/\/www.twitter.com\/SwissGRC","https:\/\/www.instagram.com\/swissgrc\/","https:\/\/www.youtube.com\/channel\/UCy4QuXYekCQrA4n5oEwJSJg","https:\/\/ch.linkedin.com\/company\/swissgrc"]},{"@type":"Person","@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author","url":"https:\/\/swissgrc.com\/en\/author\/superadmin\/","name":"superadmin","image":{"@type":"ImageObject","@id":"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/#authorImage","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/01\/logo-red.svg","width":96,"height":96,"caption":"superadmin"}},{"@type":"WebPage","@id":"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/#webpage","url":"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/","name":"DORA: What the List of Critical ICT Providers Means","description":"19 critical ICT third-party providers are now under EU oversight. Read which obligations financial entities still bear themselves under DORA.","inLanguage":"en-GB","isPartOf":{"@id":"https:\/\/swissgrc.com\/en\/#website"},"breadcrumb":{"@id":"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/#breadcrumblist"},"author":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"creator":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/dora-cloud-provider-supervisory-object-swissgrc.webp","@id":"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/#mainImage","width":1200,"height":630,"caption":"Swiss GRC article image showing the logo and an abstract control grid graphic in mint, category DORA im Betrieb"},"primaryImageOfPage":{"@id":"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/#mainImage"},"datePublished":"2026-10-07T09:02:54+02:00","dateModified":"2026-10-07T09:32:24+02:00"},{"@type":"WebSite","@id":"https:\/\/swissgrc.com\/en\/#website","url":"https:\/\/swissgrc.com\/en\/","name":"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM","description":"Governance, Risk & Compliance (GRC)","inLanguage":"en-GB","publisher":{"@id":"https:\/\/swissgrc.com\/en\/#organization"}}]},"og:locale":"en_GB","og:site_name":"Swiss GRC | Governance, Risk &amp; Compliance (GRC)","og:type":"article","og:title":"DORA: What the List of Critical ICT Providers Means","og:description":"19 critical ICT third-party providers are now under EU oversight. Read which obligations financial entities still bear themselves under DORA.","og:url":"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/","og:image":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/dora-cloud-provider-supervisory-object-swissgrc.webp","og:image:secure_url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/dora-cloud-provider-supervisory-object-swissgrc.webp","og:image:width":1200,"og:image:height":630,"article:published_time":"2026-10-07T07:02:54+00:00","article:modified_time":"2026-10-07T07:32:24+00:00","twitter:card":"summary_large_image","twitter:site":"@SwissGRC","twitter:title":"DORA: What the List of Critical ICT Providers Means","twitter:description":"19 critical ICT third-party providers are now under EU oversight. Read which obligations financial entities still bear themselves under DORA.","twitter:creator":"@SwissGRC","twitter:image":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/dora-cloud-provider-supervisory-object-swissgrc.webp","twitter:label1":"Written by","twitter:data1":"superadmin","twitter:label2":"Est. reading time","twitter:data2":"8 minutes"},"aioseo_meta_data":{"post_id":"70839","title":"DORA: What the List of Critical ICT Providers Means","description":"19 critical ICT third-party providers are now under EU oversight. Read which obligations financial entities still bear themselves under DORA.","keywords":null,"keyphrases":{"focus":{"keyphrase":"DORA critical ICT third-party providers","score":0,"analysis":[]},"additional":[{"keyphrase":"ICT third-party provider list","score":0,"analysis":[]},{"keyphrase":"Lead Overseer DORA","score":0,"analysis":[]},{"keyphrase":"Article 28 and 30 DORA","score":0,"analysis":[]},{"keyphrase":"DORA outsourcing financial entities","score":0,"analysis":[]},{"keyphrase":"FINMA Circular 2023\/01","score":0,"analysis":[]}]},"primary_term":null,"canonical_url":null,"og_title":"DORA: What the List of Critical ICT Providers Means","og_description":"19 critical ICT third-party providers are now under EU oversight. Read which obligations financial entities still bear themselves under DORA.","og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":true,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":"DORA: What the List of Critical ICT Providers Means","twitter_description":"19 critical ICT third-party providers are now under EU oversight. Read which obligations financial entities still bear themselves under DORA.","schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":"2026-10-07 07:32:30","breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-09-16 08:43:39","updated":"2026-10-07 08:19:29","focus_keyword":"DORA critical ICT third-party providers","additional_keywords":[{"word":"ICT third-party provider list","score":74,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"Lead Overseer DORA","score":74,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"Article 28 and 30 DORA","score":74,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"DORA outsourcing financial entities","score":74,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"FINMA Circular 2023\/01","score":74,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}}],"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/en\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/\" title=\"Regulation &amp; Supervision\">Regulation &amp; Supervision<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tWhen does a cloud provider become a supervised entity under DORA?\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/swissgrc.com\/en\/"},{"label":"Regulation &amp; Supervision","link":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/"},{"label":"When does a cloud provider become a supervised entity under DORA?","link":"https:\/\/swissgrc.com\/en\/dora-cloud-provider-supervisory-object\/"}],"_links":{"self":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70839","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/comments?post=70839"}],"version-history":[{"count":3,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70839\/revisions"}],"predecessor-version":[{"id":70843,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70839\/revisions\/70843"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/media\/70840"}],"wp:attachment":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/media?parent=70839"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/categories?post=70839"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/tags?post=70839"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}