EUROPEAN UNION · IN FORCE SINCE 17 JAN 2025
DORA requires financial entities to keep ICT third-party risk under control across the full lifecycle of a contract — including a documented exit strategy and assurance that a critical or important function can continue if a provider fails (Article 28). This guide explains the requirement, scope, timeline and evidence mapping for software escrow and Software Recoverability.
REGULATORY EVIDENCE MAP
EU DORA
PERIMETER
European Union
REQUIREMENT
A board-owned strategy on ICT third-party risk for critical or important functions
CASTLER EVIDENCE
Each vendor release is rebuilt and re-deployed independently, then sealed as a signed Proof of Recovery
OUTPUT
Signed Proof of Recovery
EU DORA — Articles 9(2), 28 and 30
In force since 17 January 2025Who it applies to
DORA is already applicable. Financial entities should maintain the register, contractual controls, exit plans, and testing evidence required for critical or important ICT functions.
What the regulation requires
The Castler artefact that evidences it
A board-owned strategy on ICT third-party risk for critical or important functions
Each vendor release is rebuilt and re-deployed independently, then sealed as a signed Proof of Recovery
Documented, regularly reviewed exit strategies that do not disrupt the supported function
Your exit strategy stops being a document and becomes a demonstrated, repeatable procedure
Assurance of business continuity if a provider fails, is sanctioned, or can no longer deliver
Continuity is evidenced per release — examinable by your board and your regulator
A maintained register of contractual arrangements and resilience testing
Recovery is re-verified on every release, keeping the resilience register current
THE GLOBAL REGULATORY MANDATE
Across financial regulation, cyber-resilience rules and global assurance standards, the direction is converging: critical third-party software must remain current, testable and recoverable when its provider fails.
17
MANDATES
9
JURISDICTIONS
1 · WHAT THE REGULATION IS
Regulation (EU) 2022/2554 was adopted by the European Union to create a common digital-operational-resilience standard for the financial sector. It has applied since 17 January 2025.
DORA requires financial entities to keep ICT third-party risk under control across the full lifecycle of a contract — including a documented exit strategy and assurance that a critical or important function can continue if a provider fails (Article 28). For a CIO, CISO or compliance officer, the practical issue is whether a critical third-party application can remain available when the provider fails, exits, is acquired or can no longer support the product.
Software escrow addresses custody: who holds the source code, build materials and documentation. Software Recoverability addresses the next question: whether those materials have been independently rebuilt, deployed and tested. The distinction matters because an agreement and a deposit do not prove that recovery can be completed within the institution’s operational tolerance.
Castler therefore treats the requirement as part of vendor onboarding. The agreement and first deposit are established when the relationship begins, every release is captured, and the verification evidence is renewed before an auditor, insurer or supervisor asks for it.
2 · EXACT REQUIREMENT
In summary
Article 28 requires financial entities to manage ICT third-party risk as an integral part of their ICT risk management framework. Article 30 requires contractual provisions that support contingency measures and exit strategies for critical or important functions.
Reference: Regulation (EU) 2022/2554 — Articles 9(2), 28 and 30. For legal interpretation and exact operative wording, use the current official text and advice applicable to your supervisory perimeter.
In practical terms, compliance requires more than a clause in the vendor contract. The institution must identify which applications are critical, establish custody or source-code access, ensure the deposited materials remain current, document release conditions and maintain evidence that continuity or exit can be executed.
Where the framework requires tested recovery, resilience or credible exit, a stored deposit is only the starting control. Independent build evidence, deployment instructions, architecture replication and a signed engineer review show that the recovery path has been exercised rather than assumed.
Credit and payment institutions
Investment firms
Insurance and reinsurance undertakings
Crypto-asset service providers
Institutions for occupational retirement provision
Critical ICT third-party service providers
The accountable group normally includes technology, information security, outsourcing, procurement, compliance, business continuity and the business owner of the supported service. Scope should be based on criticality, not only contract value.
In force since 17 January 2025
DORA is already applicable. Financial entities should maintain the register, contractual controls, exit plans, and testing evidence required for critical or important ICT functions.
Institutions should work backwards from the operative date. Vendor identification, agreement execution, repository integration, initial deposit, reconciliation and first verification all require lead time. Onboarding-first implementation avoids a deadline-driven retrofit.
5 · CONSEQUENCES
Supervisors can require remediation, impose administrative measures and penalties available under national implementation, and intensify scrutiny of third-party arrangements that cannot demonstrate credible continuity or exit capability.
The operational consequence can be more severe than the supervisory consequence. If a critical provider fails and the deposited software cannot be built or deployed, the institution may breach customer commitments, impact tolerances, market obligations and board-approved continuity objectives while the technical team reconstructs undocumented knowledge under incident conditions.
A current custody record and signed Proof of Recovery reduce that uncertainty. They do not replace legal analysis, incident planning or the institution’s own controls; they create tested technical evidence that those controls rely on.
6 · CASTLER EVIDENCE MAPPING
The mapping is specific: each obligation is paired with the Castler artefact or operating control that provides relevant evidence. It is not a claim that software alone guarantees compliance.
| Regulatory requirement | Castler evidence |
|---|---|
| A board-owned strategy on ICT third-party risk for critical or important functions | Each vendor release is rebuilt and re-deployed independently, then sealed as a signed Proof of Recovery |
| Documented, regularly reviewed exit strategies that do not disrupt the supported function | Your exit strategy stops being a document and becomes a demonstrated, repeatable procedure |
| Assurance of business continuity if a provider fails, is sanctioned, or can no longer deliver | Continuity is evidenced per release — examinable by your board and your regulator |
| A maintained register of contractual arrangements and resilience testing | Recovery is re-verified on every release, keeping the resilience register current |
Cloud Custody
Establish the software escrow agreement, current deposit, release history and audit trail required as the custody foundation.
Explore custody →Software Recoverability
Add independent rebuild, deployment, replication, confidence scoring and an engineer-sealed Proof of Recovery.
Explore Proof of Recovery →7 · FREQUENTLY ASKED QUESTIONS
An agreement can satisfy the contractual custody element, but EU DORA also expects the institution to manage continuity, third-party risk or recovery evidence. The exact answer depends on the clause and supervisory perimeter.
The deposit should track the production release. Automated repository capture, version history and release identifiers make it possible to show that updates and fixes are included rather than relying on the original filing.
The vendor participates in onboarding, deposit setup and structured reconciliation where documentation is missing. Verification is then designed to run independently so the vendor does not need to be present every time.
Present the executed escrow arrangement, deposit and release history, build report, deployment runbook, replication report, SBOM, confidence score, exception record and signed Proof of Recovery for the release in scope.
Yes. Cloud Custody establishes the current deposit and agreement. The same record can be upgraded to Standard or Premium Software Recoverability without creating a new custody foundation.
Re-test when the vendor releases a material version and according to the institution’s criticality, regulatory and board-approved assurance cycle. Per-release verification avoids stale annual evidence.
8 · RELATED REGULATIONS
European Union
EU NIS2
NIS2 raises the common level of cybersecurity across essential and important entities, with explicit duties around supply-chain security and the continuity of essential services during incidents.
Read the mappingEuropean Union
EU CRA
The Cyber Resilience Act sets cybersecurity requirements for products with digital elements across their lifecycle — secure development, vulnerability handling, and support obligations for manufacturers placing software on the EU market.
Read the mappingIndia
RBI §12(f)
RBI's directions on outsourcing of IT services require regulated entities to maintain robust exit strategies and business-continuity arrangements so critical operations survive a service provider's exit or failure.
Read the mappingThis guide is for regulatory orientation and does not constitute legal advice. Verify obligations against current official texts and professional advice for your entity.
CASTLER SRP EVIDENCE
EU DORA requires financial entities to maintain documented, tested and recoverable arrangements for critical ICT third-party dependencies. Castler SRP produces engineer-signed Proof of Recovery for each verified release — the independent test evidence DORA examiners expect.
EU DORA
Bring your EU DORA perimeter. We’ll map the critical systems, current custody and Proof of Recovery evidence required for a defensible procedure.
Book a 15-min briefing