The third-party concentration question DORA Article 28 actually asks.
Score your institution's five-pillar DORA maturity (Risk Mgmt · Incident · Resilience Testing · Third-Party · Information Sharing), then drill into the part the EBA's joint RTS on ICT third-party risk really cares about: Article 28 concentration, sub-outsourcing depth and which providers support Critical or Important Functions (CIFs). The mandate emits a remediation roadmap sorted by penalty exposure — the artifact a CRO can sign.
DORA (Regulation (EU) 2022/2554) entered application on 17 January 2025. Articles 28–44 set the ICT third-party risk regime; the EBA / EIOPA / ESMA Joint Final RTS (2024/1773) defines what constitutes a critical-or-important function and the sub-outsourcing oversight expected. The Critical Third-Party Provider (CTPP) designation regime is live with the European Supervisory Authorities and direct oversight of the first cohort is underway.
Set each pillar 0 → 4
0 Initial · 1 Repeatable · 2 Defined · 3 Managed · 4 Optimised. The composite is the simple sum × 5; the AP2 mandate emits each pillar separately so an agentic remediation runtime can target the weakest pillar first.
Critical ICT providers & sub-outsourcing depth
Allocate the share of critical-or-important function coverage across your top ICT third parties. The composer computes a Herfindahl-Hirschman-style concentration index and flags providers whose sub-outsourcing chain goes beyond two layers — the threshold where EBA RTS oversight expectations escalate.
| Provider | Share of CIF coverage | Sub-outsourcing depth | CIF tier |
|---|
Composite, heatmap, remediation priority
| Priority | Pillar | Action |
|---|
AP2 output
Schema includes the pillar matrix, Article 28 concentration metrics, and an ordered remediation roadmap an agentic compliance runtime can execute against.
Compose with
Pair with #3 — DORA / NIS2 Dual-Compliance Deduplicator to first surface the control overlap, then run #26 to go deep on Article 28 third-party concentration. The AP2 mandate from #26 is consumable by any agentic compliance runtime via the #7 — AP2 Visual Policy Guardrail. Position in the 259-tool atlas: Tool Chain Composer, T300 node.