We were surprised to notice the difference between the wording in Art. 6(10) DORA vs. Art. 28(3) RTS (S)RMF. In particular, because the wording in the RTS for the simplified framework is more restrictive compared to the one in DORA for the regular framework (“outsource the tasks of verifying compliance with ICT risk management requirements to ICT intra-group or ICT third-party service providers” [RTS (S)RMF] vs. “outsource the tasks of verifying compliance with ICT risk management requirements to intra-group or external undertakings” [DORA]).

The rationale of the simplified ICT risk management framework is to create lighter requirements that are proportionate to financial entities that are smaller and that offer less complex services (DORA Recital 42). There is no intention to create a specific regime for the entities subject to the simplified framework when it comes to potential use of third-party providers for the tasks of verifying compliance with DORA ICT risk management requirements.

Therefore, there is no practical difference between both provisions for the financial entities that use the simplified ICT risk management framework, they can apply DORA Art. 6(10) to comply with Art. 28(3) of the Commission Delegated Regulation (EU) 2024/1774.

In any case, the assessment of compliance with ICT risk management requirements necessitates a certain level of ICT expertise; therefore, it is expected that financial entities consider this when envisaging to contract with third parties, whether intra-group or external third-party providers.