Data delivery: ​A guide to mastering DORA data management​​

Over the past two years, we've worked alongside financial institutions across Europe as they prepared for DORA, supporting the collection, validation and management of supplier information at unprecedented scale.

The first Register of Information submissions represented a significant achievement. But they also revealed a wider challenge. The effort required to identify suppliers, gather information, validate records and maintain data quality cannot remain an annual project.

DORA has changed the role of supplier information. It is no longer simply evidence for a regulatory submission. It has become the foundation of effective third-party risk management.

The organisations that gain the greatest value from DORA will be those that embed trusted supplier information into everyday operations, creating processes that are accurate, efficient and sustainable long after the initial implementation programme has ended.

This report explores how organisations can move from compliance activity to operational maturity by building greater Visibility, Confidence and Efficiency into supplier assurance.

The next challenge has emerged

With initial DORA implementation complete, organisations are now focused on improving the quality, governance and sustainability of the supplier information that underpins effective DORA data management.

Source:
1 Deloitte., Digital Operational Resilience Act European Survey for Financial Services Entities – Q1 2025 (2025).
2 PwC Laying the groundwork for digital resilience and transformation

Trusted data underpins every stage of DORA compliance.

The Digital Operational Resilience Act (DORA) came into force in January 2025, requiring financial institutions across the European Union to strengthen ICT risk management, third-party oversight and operational resilience.

Meeting that deadline demanded significant cross-functional programmes involving procurement, third-party risk, operational resilience, information security, legal and compliance teams.

That was a significant achievement, but the challenge is now evolving.

As organisations move from implementation to ongoing governance, maintaining accurate supplier information and assurance evidence is becoming a continuous operational requirement. The focus has shifted to embedding efficient, repeatable processes that support compliance year after year.

At the heart of this challenge is obtaining and utilising trusted supplier information - efficiently.

Insight: 

While each pillar has a different objective, they all rely on the same foundation: trusted supplier information.

The aim is to collect the right information in a single, well-designed process that reduces repeated requests, minimises unnecessary back-and-forth with suppliers and creates a trusted data foundation that can be reused across the business for multiple DORA requirements.

Benchmark your third-party information maturity.

The ability to comply with DORA isn't determined by the size of your supplier population or the number of people managing it. It is determined by how effectively your organisation can access, trust and act upon supplier information.

Use the maturity model below to identify your current position and the capabilities required to build a more resilient, efficient and sustainable approach to DORA compliance.

Insight:

It's normal for organisations to demonstrate characteristics across multiple maturity levels.

Different business functions often operate different processes, reflecting their own priorities, resources and regulatory responsibilities.

As DORA operations standardise, reduce duplication and build repeatable processes to support compliance annually. The result is greater operational resilience and efficiency, lower compliance costs and more time for teams to focus on managing risk rather than managing admin.

Three practical steps to support sustainable DORA compliance.

Maintaining DORA compliance requires organisations to develop three core capabilities: Visibility, Confidence and Efficiency. Together, these capabilities create the foundation for stronger ICT third-party oversight, better decision-making and a more sustainable approach to ongoing governance.

Each capability builds on the one before it. Organisations cannot establish confidence without visibility, and efficiency can only be achieved when supplier information is visible, trusted and consistently managed. 

Insight:

DORA doesn't require every ICT supplier to receive the same level of scrutiny. It requires organisations to establish a trusted information foundation that enables proportionate oversight. When supplier information is accurate, accessible and maintained, organisations can prioritise assurance activities according to criticality, ICT dependency and regulatory obligations.

The result is a more efficient approach to DORA compliance, giving teams more time to focus on managing risk rather than administering it.

Build a complete, connected view of your ICT supplier ecosystem.

Visibility is built by collecting the relevant information, connecting it across the organisation and using it to understand supplier risk and operational dependencies.

Visibility is built by collecting the relevant information, connecting it across the
organisation and using it to understand supplier risk and operational dependencies.

1. Collect the right information

Create a consistent foundation of supplier information that supports DORA, including:

• ICT services provided

• Criticality and dependency information

• Contracts and regulatory documentation

• Assurance evidence and certifications

• Risk, control and subcontractor information

2. Make information accessible

Eliminate the reliance on spreadsheets and individual knowledge by making information available to the relevant teams, including:

• Procurement

• Third-Party Risk

• Operational Resilience

• Information Security

• Compliance

• Legal

• Executive & Board Reporting

3. Connect your supplier data ecosystem
Bring together supplier-provided information, external intelligence and internal business systems to create a richer understanding of ICT suppliers, dependencies and operational risk.

4. Create a single source of truth
Consolidate supplier information into a trusted record that supports every stage of DORA compliance.

Build trust in the information that supports DORA.

1. Collect information directly from suppliers

Prioritise primary supplier information wherever possible. Information provided and maintained by the supplier is more reliable than data aggregated or scraped from external sources alone, particularly where regulatory reporting, contractual obligations and assurance evidence are required.

2. Validate critical information

Introduce appropriate validation for the information that matters most.

This may include:

• Independent verification

• Supporting documentation

• Human validation

• Consistency and completeness checks

3. Keep information current

Supplier information should reflect today's operating environment, not last year's assessment. Establish review cycles, supplier update processes and change notifications to ensure information remains accurate as suppliers, contracts and ICT services evolve.

4. Monitor for change

Continuous monitoring enables organisations to respond quickly as supplier risk evolves.

This may include:

• Financial deterioration

• Cyber incidents

• Sanctions

• Adverse media

• Material changes to ICT services or operations

Build a sustainable operating model for DORA.

For many organisations, DORA was delivered as a dedicated programme involving multiple teams, systems and workstreams. Maintaining those activities in the same way every year is neither practical nor sustainable. Building an efficient operating model starts by asking one simple question:

If you were designing your DORA processes today, what would you do differently?

1. Collect information once

Create a common supplier information standard that supports multiple DORA requirements and business functions, reducing duplicate requests and unnecessary effort for both your teams and your suppliers.

2. Share trusted information

Enable Procurement, Third-Party Risk, Operational Resilience, Information Security, Legal and Compliance teams to access the same trusted supplier information, eliminating duplicate data collection and creating consistent decision-making.

3. Automate repeatable activities

Automate supplier onboarding, review cycles, reminders, change notifications and data synchronisation wherever possible. Reserve manual effort for activities that require judgement rather than administration.

4. Build collaboration into your operating
model

Share common supplier information, adopt collaborative assurance approaches and learn from peers to reduce duplication, improve consistency and minimise the burden placed on
suppliers.

Building sustainable DORA compliance through a community model.

The three capabilities explored in this report - Visibility, Confidence and Efficiency - provide a practical framework for building a more mature approach to DORA.

Achieving these capabilities, however, requires more than technology alone. It requires an operating model that reduces duplication, builds trust in supplier information and enables organisations to collaborate where common challenges exist.

The Hellios Community Model brings these capabilities together, creating a single, trusted supplier information foundation that supports multiple business functions, integrates with existing systems and reduces effort for both financial institutions and suppliers.

VISIBILITY

One trusted source of supplier information.

CONFIDENCE

Validated, maintained and enriched supplier
data.

VISIBILITY

Shared across teams, integrated into existing
systems and supported by industry collaboration.

10.5 hours Average admin saved per supplier each year

75% Administration efficiency gain

1 FTE Capacity released for every 150 suppliers

Source: www.hellios.com, 234,000 Interactions Saved: How Hellios Reduces Supplier Assurance Work

Shared supplier information doesn't just improve data quality. It gives teams across the business the capacity to focus on managing risk and compliance rather than administering it.

Building deeper assurance for your critical ICT providers.

DORA requires financial institutions to take a proportionate approach to ICT third-party risk.

While trusted supplier information provides the foundation for effective oversight, organisations may require additional assurance for suppliers supporting critical or important functions.

What deeper assurance looks like

Rather than simply collecting supplier information, deeper assurance examines the effectiveness of the controls that support operational resilience.

• Information Security

• Supply Chain

• Data Privacy

• People & Physical Security

• Cyber Security

• Technology

• Business Continuity Management

• Record Management

A pooled approach to assurance

Rather than each financial institution commissioning separate supplier audits, pooled audits allow one independent assessment to satisfy the assurance requirements of multiple organisations.

• Increases supplier coverage

• Deepens assurance insight

• Reduces duplication for suppliers

• Focusing resource on reviewing findings

• Facilitates conversations with suppliers

Supplier information creates Visibility.
Independent assurance builds Confidence.
Pooled audits deliver Efficiency.