When a financial customer sends a DORA questionnaire, it is checking the contract topics in Articles 28 and 30: service description, data locations, data security, incident help, audit rights, testing and exit. Answer each with a document, a date and an owner. Say plainly when you do not have something.
DORA is Regulation (EU) 2022/2554. It binds financial entities, and it reaches vendors through their contracts. No vendor holds a DORA certificate, so be careful with any wording that suggests otherwise.
Why do vendors get these questionnaires?
Article 28(3) requires a financial entity to keep a register of information on all contractual arrangements for ICT services and to report to supervisors at least yearly. Your customer needs facts from you to fill it in. Article 30 then lists what contracts must contain, so questionnaires tend to mirror it.
What does Article 30 ask for?
For every contract, the text lists a full description of services, data locations, data security provisions, access to and return of data on insolvency or termination, assistance with incidents, and cooperation with authorities. Rights and obligations must be written down, including service levels.
For services supporting critical or important functions, it adds precise quantitative and qualitative performance targets, business continuity testing, participation in threat led penetration testing, audit and access rights, and a mandatory transition period on exit.
How should you structure answers?
Use the same order as the contract topics and keep answers short.
For each question give three things: the answer, the evidence it rests on, and the date the evidence was produced. For example, for data locations: the regions you operate in, a link to your published subprocessor list or hosting description, and the date you last reviewed it.
Separate three kinds of statements. What you do today, with evidence. What you are working on, with a target quarter you can hold. What you do not do. Mixing them is how vendors end up with an answer that does not survive an audit.
Do not describe a certification you do not hold. If a customer asks about a standard that is in progress, say it is in progress.
Which answers cause trouble?
Incident reporting. Customers must notify supervisors on staged deadlines set in Delegated Regulation 2025/301, so they will ask how fast you tell them. Give a specific commitment in hours that you can meet, and name the contact path.
Subcontractors. If your service depends on other ICT providers, say so. The customer's register depends on it.
Exit. Describe how a customer retrieves its data, in what format and how long it stays available. Article 30 for critical functions requires a transition period.
Testing. Say whether you will take part in a customer's threat led penetration test and under what rules.
What to do
- Keep a standing answer library keyed to Article 30 topics.
- For each answer, attach evidence and its date.
- Mark every item as done, in progress or not offered.
- Publish a subprocessor list and an incident notification commitment.
- Document an exit procedure with data format and retention period.
- Review the library every quarter and after any contract template change.
Quick check
Does a vendor need a DORA certificate?
No such certificate exists. DORA applies to financial entities, and vendors meet it through contract terms and evidence.
What should an incident answer include?
A notification time in hours that you can actually meet, a named contact path and what information you will provide, so the customer can meet its own reporting deadlines.
Sources
- EUR-Lex: Regulation (EU) 2022/2554 (DORA), Articles 28 to 30
- Advisera: time limits in Delegated Regulation 2025/301
Last reviewed: 18 October 2026.
