B_05.02 — ICT supply chain | DORA Register of Information

Purpose

This template documents the supply chain of ICT services — tracking who subcontracts to whom. It maps the chain of providers involved in delivering a specific ICT service under a contractual arrangement.

Each row represents one link in the supply chain, identifying the provider, the service type, the rank (depth in the chain), and the recipient of the subcontracted service. Rank 1 is the direct provider to the financial entity; rank 2 and above represent subcontractors.

ICT risk management teams use this template to assess concentration risk and understand the full dependency chain for critical services.

Fields Reference

Code	Field Name	Type	Req.	Description
c0010	Contractual arrangement reference number*	text	Yes	Reference to the contractual arrangement Max length: 255 FK → B_02.01 (c0010)
c0020	Type of ICT services*	select	Yes	Type of ICT services in the supply chain Show 13 allowed values `ICT_1` — ICT consultancy `ICT_2` — ICT development `ICT_3` — ICT infrastructure operations & support `ICT_4` — ICT help desk and first level support `ICT_5` — ICT security `ICT_6` — ICT networks `ICT_7` — ICT data management (including data storage and processing) `ICT_8` — Cloud services – IaaS `ICT_9` — Cloud services – PaaS `ICT_10` — Cloud services – SaaS `ICT_11` — Software licensing `ICT_12` — ICT project management `ICT_99` — Other ICT services
c0030	Identification code of the ICT third-party service provider*	text	Yes	Provider identification code in the chain Max length: 255 FK → B_05.01 (c0010)
c0040	Type of code*	text	Yes	Type of identification code for the provider Max length: 50
c0050	Rank of the ICT third-party service provider in the chain*	number	Yes	Rank: 1 = direct provider, 2+ = subcontractor
c0060	Identification code of the ICT third-party service provider receiving sub-contracting	text	No	ID of the entity receiving sub-contracted services Max length: 255 FK → B_05.01 (c0010)
c0070	Type of code of the recipient of sub-contracting	text	No	Type of identification code for the sub-contracting recipient Max length: 50

Relationships

References (outgoing)

→

B_02.01(c0010 → c0010)

Contractual arrangements - General information

→

B_05.01(c0030 → c0010)

ICT third-party service providers

→

B_05.01(c0060 → c0010)

ICT third-party service providers

Validation Rules

Arrangement reference must exist in B_02.01. The supply chain must be linked to a valid contractual arrangement.
Provider must exist in B_05.01. Both the provider and the recipient in the supply chain must be registered in the providers master list.
Rank must be 1 or greater. Rank 0 is not valid. The direct provider has rank 1, their subcontractor has rank 2, and so on.
Consistent chain. The recipient of a rank N provider should match the provider of a rank N-1 entry for the same arrangement and service type.

Example

Field	Value
Arrangement Reference	`CA-2025-001`
Service Type	`IS_1`
Provider ID	`PROV-002`
Provider Code Type	LEI
Rank	2
Recipient ID	`PROV-001`
Recipient Code Type	LEI

Common Mistakes

Rank set to 0. The minimum valid rank is 1. Zero-ranked entries are rejected during validation.
Referencing providers not in B_05.01. Both the subcontractor (provider) and the entity they subcontract to (recipient) must be registered in the providers master list before being used here.
Broken chain links. The recipient at one rank level should match the provider at the previous rank level. Gaps in the chain make the supply chain mapping incomplete.