Software supply chain controls map to DORA mainly through the ICT risk management framework in Article 6, the asset inventory duty in Article 8, protection measures in Article 9, and third-party risk rules in Articles 28 and 30. DORA applies from 17 January 2025. It does not name SBOMs, so the mapping is a reading, not a mandate.
This is a guide to the text, not legal advice. Your regulator and counsel decide what applies to your firm, and the Regulation itself is the authority.
What does DORA say in the relevant articles?
We read the Regulation (EU) 2022/2554 text on EUR-Lex. Key phrases:
- Article 6(1): financial entities shall have "a sound, comprehensive and well-documented ICT risk management framework."
- Article 8(4) and 8(6): identify all information assets and ICT assets, including those on remote sites, and "maintain relevant inventories."
- Article 9(1) and 9(2): "continuously monitor and control the security and functioning of ICT systems," and design, procure and implement ICT security policies, procedures, protocols and tools.
- Article 28(1): manage ICT third-party risk "as an integral component of ICT risk."
- Article 28(3): maintain a register of information on all contractual arrangements for ICT services provided by third parties.
- Article 30(2) and (3): contracts must include listed elements, and for services supporting critical or important functions, more, including exit strategies with a transition period.
- Article 64: it applies from 17 January 2025.
How do supply chain controls line up?
Asset inventory (Article 8). Software is an ICT asset. An inventory of the applications you run, and of the components inside the ones you build, supports the duty to keep relevant inventories. A software bill of materials per release is one way to keep that list current.
Protection and monitoring (Article 9). Continuous vulnerability findings, dependency policies in the build pipeline and secrets detection are tools that fit "design, procure and implement" security tools. Keep a record of what the control is, where it runs and who reviews it.
Third-party risk (Article 28). Your suppliers include software vendors and open source maintainers. The register in Article 28(3) concerns contracts for ICT services, so it covers vendors rather than libraries. Still, the vendor questions you ask under Article 28(4), before entering an arrangement, can include how they produce and update software, and whether they can share a bill of materials.
Contracts and exit (Article 30). For critical services, ask for terms that cover security measures, incident help and a defined transition period. Software you cannot replace quickly is an exit risk. Dependency data helps you see which components are hard to swap.
What evidence should you keep?
Auditors and supervisors want proof the control exists and runs. Keep:
- Dated inventories and SBOMs per release.
- Vulnerability findings with owner, severity and fix date.
- Pipeline policy settings and exceptions with approvals.
- The vendor register and due diligence notes.
- Contract clauses on security, notification and exit.
Safeguard's compliance automation can map findings and evidence to framework controls, and the framework mapping demo shows the idea. It does not certify you or make you DORA compliant.
See the walkthrough at /demos/framework-mapping.
What to do
- List the ICT assets in scope and mark which are software you build or buy.
- Produce an SBOM for each release of in-scope applications.
- Define who reviews vulnerability findings and how fast they must act.
- Add software supply chain questions to vendor due diligence.
- Check critical vendor contracts for security, incident and exit terms.
- Store the evidence where an auditor can find it.
Quick check
Does DORA require an SBOM?
Not by name, in the text we read. SBOMs help meet the inventory and monitoring duties, but check with your supervisor and counsel.
Since when does DORA apply?
Article 64 says it applies from 17 January 2025.
Sources
Last reviewed: 18 October 2026.
