DORA never tells you to watch the public record.

DORA, formally Regulation (EU) 2022/2554, has applied since 17 January 2025, and no article in it tells a financial entity to watch its ICT providers in public sources. Instead it builds obligations that only work if you already know how your provider is doing, and then leaves the knowing to you.

The alternative is worse. Most pages on this subject will tell you DORA mandates continuous third-party monitoring, and a fair few name Article 28(6) as the source. Article 28(6) is about scheduling audits and inspections. That takes about ten minutes to check, and once you've checked, why would you believe anything else on the page?

what DORA actually says about monitoring.

The third-party regime is Chapter V, Section I. Below are the provisions that carry the monitoring language and when each one bites. One caveat on the last row: Delegated Regulation (EU) 2024/1773 governs your policy on ICT services supporting critical or important functions, not every ICT contract you hold.

That last one is the only article in the whole framework actually called “Monitoring of the contractual arrangements”, and every input it names comes either from the provider or from your own auditors. No registry, no court docket, no press.

“Adverse media” and “negative news” appear nowhere in DORA, or in any of its Level 2 acts. “Insolvency” turns up four times and never once as something to detect: Article 29(2) asks which insolvency law would apply before you contract, Article 30(2)(d) asks for a contractual right to get your data back if it happens, Article 15(e) tells the supervisory authorities to write a standard about testing for it, and the fourth sits in a recital. The duty to plan and test for a provider's collapse lands a level down, in Articles 25 and 26 of Delegated Regulation (EU) 2024/1774.

the three obligations that assume you already know.

DORA doesn't ask you to watch. It asks you to do three things that are impossible if you aren't watching.

• Article 28(7)(b). Your contract must be terminable on “circumstances identified throughout the monitoring of ICT third-party risk that are deemed capable of altering the performance of the functions provided… including material changes that affect the arrangement or the situation of the ICT third-party service provider”. You can't exercise a right you don't know has been triggered.
• Article 30(3)(b). For a critical or important function, the contract must oblige the provider to notify you of any development that might materially affect its ability to deliver. So DORA's detection mechanism is the provider telling you, which depends on the provider wanting to.
• Delegated Regulation (EU) 2024/1774, Articles 25 and 26. Your continuity and recovery plans must consider and test scenarios linked to the insolvency or failure of an ICT provider. Planning for the collapse is required. Noticing it is not.

There's a quieter one too. Article 8(3) of Delegated Regulation (EU) 2024/1773 is another critical-or-important policy rule, and it says you shall not, over time, rely solely on third-party certifications or on audit reports the provider makes available. You have to keep verifying they haven't gone obsolete. The regulation is assuming that kind of assurance goes stale, and in practice it does.

where a public-record watch fits in the text.

One place, and it's a modest one. Delegated Regulation (EU) 2024/1773 sets out what your policy on ICT services supporting critical or important functions has to contain. Its Article 6(3) lists five permitted sources of assurance in due diligence. Four of them are audits, independent assessments and certifications. The fifth, point (e), is “the use of other relevant information available to the financial entity or other information provided by the ICT third-party service provider”.

That is the citation for what we do, and it is a thin one. Open-ended, one option out of five, and sitting in an instrument that only governs your critical-or-important policy to begin with. Article 6 is titled “Due diligence”, and it frames the whole list around selecting and assessing a prospective provider. Which is the same pre-contract objection we've just made about everything else. It applies here too.

Article 6(4) pushes it past signature: it wants an appropriate level of assurance and, where appropriate, more than one of those elements, read alongside Article 8(3)'s duty to keep checking that the assurance you have hasn't gone obsolete. So a public-record watch is what makes three DORA controls work on time. DORA itself names no such control.

Two nearby provisions get quoted as though they said more. Article 6(1)(a) does name business reputation and adequate financial resources among the things to assess about a provider, and Article 6(1)(d) names the risk of being affected by restrictive measures, including embargos and sanctions. Both are expressly assessments made before entering into a contractual arrangement. Recital 65 then describes a strategy “rooted in a continuous screening of all ICT third-party dependencies”, which is about as close as DORA gets to describing this work. But it's a recital, which tells you how the drafters wanted the articles read and creates nothing on its own.

DORA sets no monitoring frequency.

Nothing in the regulation or its Level 2 acts says how often to look. There are fixed annual cadences in the neighbourhood, and every one of them is about something else: Article 28(3) has you report to your competent authority at least yearly on new ICT arrangements, Article 11(6)(a) has you test your continuity and recovery plans at least yearly, and Article 3(1) of Delegated Regulation (EU) 2024/1773 has the management body review the critical-or-important policy at least once a year. None of those tells you how often to look.

So the cadence is yours to pick on a risk basis, and yours to evidence. Evidencing it is the expensive part. A watch that ran every week for two years and found nothing has to be provable, or it may as well not have run. Ours arrives as a dated weekly log whether or not anything happened, and comes back as an export when someone asks.

see a full weekly watch log, anonymized →

the register of information asks who a provider is, never how it is doing.

Article 28(3) makes you keep a register of information covering every contractual arrangement for the use of ICT services, and Implementing Regulation (EU) 2024/2956 sets the templates it is reported in. Two of them describe the provider, and it is worth reading what they actually ask for.

Template B_05.01 wants the provider's identifier and the type of identifier, its registered legal name, the country where its head office sits, your annual expense for it, and the identifier of its ultimate parent undertaking. Template B_07.01 wants your own assessments of the arrangement and the date of your own last audit of it.

Read both lists again and notice the shape of them. Every field is either a fact about who the provider is on paper, or a record of something you did. Neither template has a field for how the provider is doing. A company can be filed correctly in your register on the day its parent enters insolvency proceedings, and the register will not know, because nothing in it was ever designed to.

We sit on one side of that gap. We do not build your register and we do not keep it current. The obligation to obtain those identifiers, to keep them accurate and to stand behind them is yours, and Article 28(1)(a) says you remain fully responsible for compliance at all times. What we do touch is the identifier column: every company you name is resolved to a registered legal entity and the alert names the identifier it matched, which is the same kind of identifier the register's LEI and EUID fields want. That is a starting point for the register.

The rest of what we do sits outside the register entirely. Filing a provider correctly and watching what happens to it afterwards are two different jobs, and only one of them has a template.

what we don't do for your DORA programme.

Article 28(1)(a) is the sentence behind all of that: you remain, at all times, fully responsible for compliance. Nothing you buy moves that, and any supplier who implies otherwise is selling you a problem.

what we do instead.

Noctovisor watches the ICT providers and other suppliers you name in the public record: company registries, court and insolvency filings, sanctions and watchlists, regulatory notices and enforcement, financial disclosures, breach and outage reports, and the trade press in the market where each one operates. Sources are picked per supplier and per country, because trouble surfaces in different places in Frankfurt and in Dallas.

When something crosses the line you set, you get one email with the document behind it. Most days you get nothing. The weekly log arrives either way.

The limit on all of it, put the way our data processing agreement puts it: if something isn't published, we won't see it, and no alert doesn't mean nothing happened. A watch on the public record is one input among the several DORA expects you to hold. Article 28(1)(a) leaves you responsible for the rest.

One row of your register to fill in now. Your register of information records the country where a provider processes your data. For Noctovisor that's Canada, with named providers in the United States, and there's no EU-only option today. Non-EU hosting is a disclosure rather than a prohibition, but it's a row you'll have to fill in. The full map is on the trust page.

One DORA-specific source is worth naming, because it didn't exist before 2025. Under Article 42(2) the Lead Overseer publicly discloses where a designated critical ICT third-party provider has failed to notify it whether it intends to follow a recommendation, or has given an explanation the Lead Overseer doesn't consider sufficient. The disclosure names the provider and the nature and type of the non-compliance.

every public source we read →

common DORA questions.

Version 1.2, 26 August 2026. Every article and instrument cited here was checked against its text on 2 August 2026. DORA's Level 2 acts and the ESAs' list of designated critical providers both move, so if you are relying on a point here, read it at the source: the consolidated regulation is on EUR-Lex. This page describes what we read and how we deliver it. It is not legal advice, and it can't tell you what your own regulator expects of you.