Question ID: DORA 227 - 3315
Regulation Reference: (EU) 2022/2554 - Digital Operational Resilience Act (DORA)
Topic: Digital operational resilience testing (DORA)
Article: 27 and 28
Status: Rejected
Date of submission: 07 Apr 2025
Question
In articles 27 and 28 DORA it is stated that a TLPT test must take place if we are a critical supplier. According to the DORA legislation itself, you assign whether we are critical or not. Because I cannot find where and how this should be requested from you, I will do it this way.
Background of the question
With some customers we want to make separate agreements if we are a critical supplier. Whether we are actually considered critical is unclear to some.
EIOPA answer
This question has been rejected because it is unclear.