# Registre d'informations selon DORA : qu'est-ce que c'est et comment le créer correctement ? > The DORA register of information is a standardized central database of all contracts between a financial company and ICT third-party providers. SwissGRC explains the four steps to create it and why a tool-based solution works better than Excel. - URL: https://swissgrc.com/fr/registre-informations-dora-comment-creer/ - Éditeur: SwissGRC® - Publié: 2024-10-07 - Dernière mise à jour: 2024-10-07 ## Points clés - DORA comes into force on January 17, 2025, and the register of information is a central instrument for its practical implementation. - The register of information records all contractual agreements of a financial company with ICT third-party service providers, including the ICT services used, the providers and the supported business and operational functions. - The register covers all ICT services, but critical or important functions must be listed in more detail. - Creating the register involves four steps: identifying critical and important functions, documenting ICT third-party providers, documenting ICT services, and consolidating the information in the standard templates specified by DORA. - Excel reaches its limits for this register because of limited scalability, rudimentary security functions, missing versioning and consistency, and high manual effort with a risk of errors. - SwissGRC recommends a tool-supported solution that offers automation, central data management on one platform and advanced security features, such as the GRC Toolbox. **The countdown is on: The [Digital Operational Resilience Act (DORA)](https://swissgrc.com/digital-operational-resilience-act-dora/) comes into force on January 17, 2025, and the financial sector is preparing intensively for the new requirements. DORA is currently the dominant topic in the industry – as demonstrated by the great response to the BaFin conference “IT supervision in the financial sector: What does DORA mean in practice?” on September 26, 2024. Thousands of participants learned about the final steps towards implementation. A central instrument in the practical implementation of DORA is the register of information. In this article, you will learn what the register of information is all about, how to create it and why the right approach is crucial to meeting the requirements efficiently and on time.** What is the DORA register of information? The register of information under [DORA](https://swissgrc.com/en/dora) is a standardized central database that records all contractual agreements of a financial company with ICT third-party service providers. It contains detailed information about the ICT services utilized, the providers, and the supported business and operational functions. The register enables systematic monitoring of dependencies and risks arising from the use of ICT third-party providers and serves to provide this information to the relevant supervisory authorities. It encompasses all ICT services; however, particularly critical or important functions must be listed in more detail. **Main Benefits:** - **For financial companies**: The register of information helps companies systematically capture and monitor all contractual dependencies related to ICT services. This facilitates risk management, enhances transparency regarding critical ICT third-party providers, and enables better preparation for potential ICT-related incidents. - **For the entire financial sector**: The register of information allows supervisory authorities to comprehensively monitor the dependencies of financial institutions on ICT third-party providers and identify critical service providers. This ensures that systemic risks are recognized early and coordinated measures are implemented to maintain digital resilience throughout the financial sector. How do you create a DORA-compliant register of information? The creation of a DORA-compliant register of information involves four main steps: 1. **Identification of critical and important functions**: First, determine which operational and business functions are essential for maintaining business operations and meeting regulatory requirements. 2. **Documentation of ICT third-party service providers**: Identify all providers delivering ICT services, and document the contractual details and dependencies. 3. **Documentation of ICT services**: Record all ICT services and associate them with the identified critical or important functions. 4. **Consolidation of information**: Enter the collected information into the standard templates specified by DORA to ensure uniform reporting. Why Excel is not enough Many companies initially rely on Excel to manage the register of information, as it appears to be a quick and cost-effective solution. However, practice shows that Excel quickly reaches its limits for the long-term management of such a complex and dynamic register: - **Limited scalability:** as the complexity of the company grows, maintaining a register of information in Excel becomes confusing and difficult to manage (PwC, 2023). - **Security risks:** DORA requires strict security measures to protect sensitive data. However, Excel only offers rudimentary security functions (EBA, 2023). - **Lack of versioning and consistency:** In Excel, it is difficult to track changes and ensure consistency, especially if several people are working on it at the same time (BaFin, 2024b). - **High manual effort and susceptibility to errors:** Merging and consolidating data from different sources is time-consuming and prone to human error. The advantages of our tool-based solution In order to meet the requirements of DORA and manage the information register efficiently, companies should rely on a tool-supported solution. This offers the following advantages: - **Automation:** Reduce manual input and minimize errors through automated processes. - **Central data management:** Instead of working in different Excel files, all parties involved can access the current information register via a central platform. - **Increased security:** Tool-based solutions such as the GRC Toolbox offer advanced security features to ensure the protection of sensitive data in accordance with DORA (European Commission, 2023) Conclusion The information register is an essential component of the DORA requirements and will be the focal point for the digital resilience of financial service providers. In light of the upcoming enforcement of DORA and the increasing relevance of this topic, it is crucial for companies to take the right steps now. Those who invest early in a structured and efficient solution will be well-prepared not only to meet the new regulatory requirements but also to benefit in the long term from the insights gained. **Would you like to learn more about how to efficiently and DORA-compliantly design your information register?** Feel free to contact us for more information about the solutions from Swiss GRC. You can also book a Discovery Call directly to find out how we can support your company: [swissgrc.com/discoverycall](https://www.swissgrc.com/discoverycall). ## Questions fréquentes ### What is the DORA register of information? It is a standardized central database that records all contractual agreements of a financial company with ICT third-party service providers. It contains details on the ICT services used, the providers and the business and operational functions they support. ### How do you create a DORA-compliant register of information? There are four steps: identify critical and important functions, document the ICT third-party providers, document the ICT services and link them to those functions, and enter the consolidated information into the standard templates specified by DORA. ### Why is the register of information important for supervisory authorities? It allows supervisory authorities to monitor the dependencies of financial institutions on ICT third-party providers and to identify critical service providers. This helps to recognize systemic risks early. ### Is Excel enough for the DORA register of information? According to the article, Excel quickly reaches its limits. It scales poorly, offers only rudimentary security functions, makes versioning and consistency difficult, and requires a lot of manual work that is prone to errors. ### What are the advantages of a tool-based solution for the register of information? A tool-based solution automates processes and reduces manual input and errors. All parties involved access the current register on a central platform, and advanced security features protect sensitive data.