DORA register of information software for ICT providers

The DORA register of information is maintained with tools that manage ICT providers and contracts, fill in the templates of Implementing Regulation (EU) 2024/2956 and export the package in the format your authority sets, for example xBRL-CSV in a .zip. No software files it for you or guarantees it is correct: responsibility stays with the financial entity.

Which software maintains the DORA register of information

Article 28(3) of Regulation (EU) 2022/2554 (DORA) requires financial entities to maintain and update a register of information on all contractual arrangements for the use of ICT services provided by ICT third-party service providers, at entity level and, where relevant, sub-consolidated and consolidated level [1]. Implementing Regulation (EU) 2024/2956 sets the standard templates for that register [2].

Each national authority decides the window and the channel. As an example, the Central Bank of Ireland asked for registers with a 31 December 2025 reference date between 2 and 31 March 2026, as an XBRL OIM-CSV file under the EBA DPM 4.0 taxonomy packaged in a .zip, with later EBA data quality checks that may require resubmission [3]. Luxembourg's CSSF opened its portal from 11 February to 31 March 2026 with the same reference date, and asked entities to send their LEI beforehand [4]. Always check your authority's current notice.

There are four usual options:

Whichever option you choose, check that the tool:

1. Stores each contract as a record with its relationships (entity, provider, service, subcontractors, functions supported).
2. Produces the package in the format your authority requires and validates before you submit.
3. Flags inconsistent data, for example a service marked non-critical when your impact analysis ties it to a critical or important function.
4. Records changes (renewals, new subcontractors) so the register stays alive, not only before the annual submission.
5. Allows review and sign-off by the responsible person.

To understand the templates, we have the guide DORA Register of Information: how to complete the template and the most common ICT register mistakes. And if you are an ICT provider, even outside the EU, your financial customers will ask you for the data for their register: prepare your side too.

Which software helps with DORA compliance and the register

The register is only one part. DORA is organised around five areas: ICT risk management, incident management and reporting, resilience testing, ICT third-party risk, and information sharing. No tool covers them all equally, and it helps to know what each category solves:

• ICT risk: GRC and risk management, asset and function inventory.
• Incidents: incident register with classification and deadlines; you file the notification.
• Resilience testing: testing teams and tools, including threat-led advanced testing; not a compliance module.
• ICT third parties: TPRM and the register itself.
• Information sharing: agreements and communities; not compliance software.

Be wary of anyone promising "DORA in a box". The reasonable approach is to cover the areas with different tools and gather the evidence in one place.

Software with gap analysis, RoI and DORA compliance

Gap analysis. A good analysis compares your situation with each applicable area and article and returns a prioritised list, with an owner and a pending piece of evidence per gap. Ask for it to be exportable and repeatable every quarter, so you can see progress.

RoI. In this context RoI means Register of Information, the register we are discussing. If by "ROI" you mean return on investment, we publish no figures: to justify a tool, compare your current manual effort to maintain the register and handle resubmissions with what the tool automates, and measure with your own data.

Compliance. The tool should be able to show what it covers and what it does not. If it does not state its limits, treat that as a warning sign.

Where HodeiShield fits

HodeiShield documents the following in its DORA use case, and nothing more:

• Register of information: it generates the register as an xBRL-CSV package with the EBA structure (including the reportPackage.json file and the b_01.01 to b_99.01 templates). A sample package built on fictitious entities can be requested through a form. It does not submit it: you do that through the official channel.
• ICT providers: a register with criticality, exit plans and audit rights; it flags per provider whether an exit plan and an audit right exist and computes coverage. Negotiating the clauses is up to you.
• Concentration: HHI index and a three-hop impact radius over the dependencies you declare.
• Incidents: a classifier with DORA criteria and a single register that also feeds NIS2 and GDPR; you prepare and send the notification.
• Gap analysis by pillar: ICT third-party risk, direct coverage; ICT risk management and incident management, partial; resilience testing and information sharing, not covered.

Its declared limits: it does not submit the register, does not run resilience tests or threat-led penetration testing (TLPT), is not real time, and its FAIR estimate is not a breach probability. For the third-party module, see third-party risk management.

Our point of view

Decide first who will maintain the register and which data source feeds it; the tool comes after. If you need regulatory support, our DORA compliance solution and GRC consulting cover the gap analysis and the plan, and the DORA compliance manual summarises the framework. The EBA keeps a reference page on DORA [5].

Frequently asked questions

What is the DORA register of information?

It is the register, set out in Article 28(3) of DORA, of all the financial entity's contractual arrangements for ICT services provided by third parties, with standard templates [1] [2].

Which format is sent to the authority?

Each national authority sets it. For example, the Central Bank of Ireland asked for an XBRL OIM-CSV file under EBA DPM 4.0 in a .zip [3]. Check your authority's notice.

Can software submit the register for me?

Usually not: it produces the package and the entity submits it through its authority's channel. Check exactly what each tool does.

Is an ICT provider outside the EU also affected?

DORA applies directly to financial entities; providers designated as critical also fall under their own oversight framework run by the European authorities [5]. Either way, the entity must register its contracts with you, so it will ask you for data and clauses.

Do I need a tool, or is a spreadsheet enough?

For a few contracts it may be enough; with many providers, entities or frequent changes, a tool reduces errors and makes it easier to keep current.

Next step

Want a DORA gap analysis and a review of how you maintain the register? Tell us about your case or discover HodeiShield.

Sources

1. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). EUR-Lex (Official Journal of the EU), 2022-12-14. https://eur-lex.europa.eu/eli/reg/2022/2554/oj
2. Commission Implementing Regulation (EU) 2024/2956 laying down implementing technical standards for the register of information. EUR-Lex (Official Journal of the EU), 2024-11-29. https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj
3. Reporting Registers of Information (DORA). Central Bank of Ireland. https://centralbank.ie/regulation/digital-operational-resilience-act-dora/reporting-registers-of-information
4. DORA: submission timeframe for the register of information, eDesk portal open as of 11 February 2026. CSSF (Luxembourg), 2026-02-11. https://www.cssf.lu/en/2026/02/dora-submission-timeframe-for-register-of-information-edesk-portal-open-as-of-11-february-2026/
5. Digital Operational Resilience Act (DORA). European Banking Authority. https://www.eba.europa.eu/activities/direct-supervision-and-oversight/digital-operational-resilience-act