Glossary term
Critical ICT Third-Party Provider (CTPP)
Also: DORA CTPP, Lead Overseer-supervised provider
ICT third-party provider designated critical by the European Commission under DORA Art. 31, falling under direct supervision of one of the three European Supervisory Authorities (EBA, EIOPA, ESMA). First CTPP designations expected in 2025/2026.
Designation criteria under DORA Art. 31 and Delegated Regulation (EU) 2024/1502: systemic importance in the EU financial sector, number of financial entities served, substitutability, critical functions, interconnectivity. AWS, Microsoft Azure, Google Cloud, Oracle, IBM, SAP, Salesforce are likely candidates.
Consequences of CTPP designation: direct supervision by a Lead Overseer (one of the three ESAs), on-site inspection powers, sanctioning powers, ability to order risk-mitigation measures. CTPPs pay supervisory fees. Fines up to 1 percent of average daily worldwide turnover per day of continued breach.
In practice
Consequences for financial entities as customers: contracts with CTPPs are subject to stricter requirements. Information demands grow because the Lead Overseer can also inspect at the financial entity. CTPP relationships must be flagged separately in the information register.
Related terms
DORA
EU regulation on digital operational resilience in the financial sector. Directly applicable since 17 January 2025. Five pillars: ICT risk management, incident management, resilience testing including TLPT, third-party governance, information sharing.
Lead Overseer (DORA)
One of the three European Supervisory Authorities (EBA, EIOPA, ESMA) responsible under DORA Art. 32 for direct supervision of an ICT third-party provider designated as critical. Assigned by the ESAs' Joint Committee.
ICT Third-Party Risk
Sammelbegriff für Risiken aus dem Einsatz externer ICT-Lieferanten: Cloud-Provider, SaaS-Anbieter, MSPs, MSSPs. Unter DORA Art. 28 explizit reguliert; jeder kritische Lieferant muss in einem Register stehen und einer dokumentierten Eignungsprüfung folgen.
ICT Concentration Risk
Risk arising from dependence on a small number of or a single ICT third-party provider. DORA Art. 29 obliges financial entities to perform an explicit analysis and steering. Supervisors focus particularly on cloud hyperscalers and core banking system providers.
CASB
Security layer between users and SaaS providing visibility (shadow IT discovery), data protection (DLP), compliance, and threat protection across SaaS apps. Four functions per Gartner: visibility, compliance, data security, threat protection.
CNAPP
Gartner platform category that combines CSPM, CWPP, CIEM, KSPM, DSPM and IaC scanning into one tool. Answer to tool fragmentation in cloud security stacks.
Compliance mapping
The explicit link between a decision (vendor, architecture, control) and the specific regulatory articles, controls or standards it satisfies. Without compliance mapping, a memo cannot be defended under audit against a named clause.
Confidential Computing
Hardware-based isolation that keeps data encrypted during processing (data-in-use). Complements encryption at rest and in transit. Technologies: Intel SGX, Intel TDX, AMD SEV-SNP, ARM CCA, Nvidia H100 Confidential Computing.