Your Vendor’s Problem Is Now Yours: What Critical Third-Party Designation Actually Changes

Introduction When European regulators started designating certain ICT providers as critical under DORA, some organisations read it as good news: a vendor now facing direct supervisory oversight sounded like someone else doing the compliance work. The opposite is true. Designation puts a vendor under a regulator’s microscope.