{"product_id":"dora-ikt-underleverantorsbyte-risk-invandning-exit","title":"DORA – change of ICT sub-service provider, risk assessment \u0026 objection | Word\/PDF\/Excel","description":"\u003csection lang=\"sv\" class=\"mb-product-description\" style=\"line-height:1.67;color:#183B57\"\u003e\n\u003cp\u003e\u003cstrong\u003eYour cloud provider or operations partner notifies you that an important ICT sub-supplier is to be replaced. Must your financial firm accept the change?\u003c\/strong\u003e When the ICT service supports a \u003cstrong\u003ecritical or important function, or a substantial part of one\u003c\/strong\u003e, DORA and the EU's specific sub-supplier standard may require a documented risk assessment, contractual notification, and a timely decision. This specialist package helps you handle a \u003cem\u003especific change notification\u003c\/em\u003e – not just establish a general IT policy.\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eApplicable regulations:\u003c\/strong\u003e \u003ca href=\"https:\/\/eur-lex.europa.eu\/legal-content\/SV\/TXT\/?uri=CELEX:32022R2554\"\u003eDORA, Regulation (EU) 2022\/2554\u003c\/a\u003e, applies from \u003cstrong\u003e17 January 2025\u003c\/strong\u003e. The complementary \u003ca href=\"https:\/\/eur-lex.europa.eu\/legal-content\/SV\/TXT\/?uri=CELEX:32025R0532\"\u003eCommission Delegated Regulation (EU) 2025\/532\u003c\/a\u003e applies from \u003cstrong\u003e22 July 2025\u003c\/strong\u003e and covers risk assessment and conditions for subcontracting ICT services that support critical or important functions. \u003cstrong\u003eArticle 5\u003c\/strong\u003e regulates material changes; \u003cstrong\u003eArticle 6\u003c\/strong\u003e regulates certain conditions for contractual termination rights.\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eContents:\u003c\/strong\u003e 5 Swedish work templates, a Swedish user guide and a separate English User Guide in both Word (DOCX) and searchable\/printable A4 PDF, as well as an Excel register with nine tabs and \u003cstrong\u003e730 administrative formulas\u003c\/strong\u003e. Total \u003cstrong\u003e7 DOCX + 7 PDF + 1 XLSX = 15 files\u003c\/strong\u003e in a ZIP. One-time price \u003cstrong\u003eSEK 79\u003c\/strong\u003e; no physical delivery, no macros and no automated supplier integration.\u003c\/p\u003e\n\n\u003cdiv style=\"border:2px solid #BDD5E3;border-left:6px solid #28779D;background:#EDF6FB;border-radius:11px;padding:18px 21px;margin:19px 0\"\u003e\n\n\u003ch2 style=\"margin:0 0 8px;color:#1C5B7E\"\u003e01 · Package contents\u003c\/h2\u003e\n\n\u003cp style=\"margin:0\"\u003e\u003cstrong\u003eFive Swedish templates:\u003c\/strong\u003e (1) receipt and applicability, (2) risk matrix for sub-supplier change, (3) request for additional information from the ICT supplier, (4) objection and formal decision protocol, and (5) escalation, termination and exit review. Two guides are included: Swedish and English. Each document is available in editable Word and searchable PDF. The Excel workbook follows the same process. Total 15 customer files.\u003c\/p\u003e\n\n\n\u003c\/div\u003e\n\n\u003cdiv style=\"border:2px solid #BDD5E3;border-left:6px solid #28779D;background:#EDF6FB;border-radius:11px;padding:18px 21px;margin:19px 0\"\u003e\n\n\u003ch2 style=\"margin:0 0 8px;color:#1C5B7E\"\u003e02 · What the files contain\u003c\/h2\u003e\n\n\u003cp style=\"margin:0\"\u003eFill in the actual contract ID, affected critical\/important function, sub-supplier chain, data localization, risk and concentration assessment, \u003cstrong\u003eactual contractually agreed notification and objection period\u003c\/strong\u003e, requested additional information, competent decision, proof of delivery and possible exit conditions. Excel only records administrative deficiencies. \u003cstrong\u003eNo formulas send objections, approve sub-supplier changes or terminate contracts.\u003c\/strong\u003e\u003c\/p\u003e\n\n\n\u003c\/div\u003e\n\n\u003ch2\u003eWhen is this the right DORA template?\u003c\/h2\u003e\n\n\u003cp\u003eTypical users are the IT risk function, compliance, legal counsel, procurement and supplier manager, information security officer and business owner of critical or important functions in financial firms. Example event: a company with a critical financial service receives written notification that operations, infrastructure, security function or data storage is being moved to another sub-supplier, perhaps in a new country or further down the delivery chain.\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eScope:\u003c\/strong\u003e Not every IT purchase or common supplier change is a material change under Article 5. First document whether the entity is covered by DORA and whether the specific sub-supplier chain supports a critical or important function, or a substantial part of one. The same legal requirements should not be attributed to companies outside the relevant scope.\u003c\/p\u003e\n\n\u003ch2\u003eAll 15 customer files\u003c\/h2\u003e\n\n\u003cdiv style=\"overflow-x:auto\"\u003e\u003ctable style=\"width:100%;min-width:700px;border-collapse:collapse\"\u003e\n\n\u003cthead\u003e\u003ctr style=\"background:#DFEDF5\"\u003e\n\n\u003cth style=\"padding:9px;text-align:left\"\u003eDocument\u003c\/th\u003e\n\n\u003cth style=\"padding:9px;text-align:left\"\u003ePractical result\u003c\/th\u003e\n\n\u003cth style=\"padding:9px;text-align:left\"\u003eLanguage and format\u003c\/th\u003e\n\n\n\u003c\/tr\u003e\u003c\/thead\u003e\n\n\u003ctbody\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e01 Notification – receipt and applicability\u003c\/td\u003e\n\n\u003ctd\u003eDocument the sender, actual contractually agreed notice period, critical function, planned change date and delivery chain.\u003c\/td\u003e\n\n\u003ctd\u003eSV · DOCX\/PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e02 Risk assessment for sub-supplier change\u003c\/td\u003e\n\n\u003ctd\u003eAssess the impact on information security, operations, geographic risk, concentration, supervisory access and exit.\u003c\/td\u003e\n\n\u003ctd\u003eSV · DOCX\/PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e03 Request for additional information from the ICT supplier\u003c\/td\u003e\n\n\u003ctd\u003eRequest chain map, actual controls, localization, continuity plan, audit rights and implementation plan.\u003c\/td\u003e\n\n\u003ctd\u003eSV · DOCX\/PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e04 Objection and formal decision protocol\u003c\/td\u003e\n\n\u003ctd\u003eSeparate substantive risk assessment, decision and actually communicated objection before the relevant contract deadline.\u003c\/td\u003e\n\n\u003ctd\u003eSV · DOCX\/PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e05 Escalation and exit review\u003c\/td\u003e\n\n\u003ctd\u003eDocument implementation despite objection, change before deadline or unauthorized subcontracting; assess contract law and continuity.\u003c\/td\u003e\n\n\u003ctd\u003eSV · DOCX\/PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e06 User guide in Swedish\u003c\/td\u003e\n\n\u003ctd\u003eWorkflow, legal scope, chain of responsibility, sources and special pitfalls.\u003c\/td\u003e\n\n\u003ctd\u003eSV · DOCX\/PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e07 English User Guide\u003c\/td\u003e\n\n\u003ctd\u003eInstructions for using the five Swedish operational forms; not full translations of the forms.\u003c\/td\u003e\n\n\u003ctd\u003eEN · DOCX\/PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e08 Excel – register for sub-supplier changes\u003c\/td\u003e\n\n\u003ctd\u003eNine tabs and 730 formulas for registration, follow-up and manual review.\u003c\/td\u003e\n\n\u003ctd\u003eSV · XLSX\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\n\u003c\/tbody\u003e\n\n\n\u003c\/table\u003e\u003c\/div\u003e\n\n\u003ch2\u003eExcel – nine tabs for the contract and risk process\u003c\/h2\u003e\n\n\u003cp\u003eThe workbook consists of \u003cstrong\u003eRead me, Overview, Changes, Contract, Risks, Answers, Decision, Exit and Sources\u003c\/strong\u003e. Each actual change is assigned a case ID. The overview counts notifications, incomplete risk documentation, contracts to be investigated, unanswered requests, objections without actual communication and exit cases. It contains \u003cstrong\u003e730 formulas\u003c\/strong\u003e and has passed \u003cstrong\u003e23 out of 23 scenario tests\u003c\/strong\u003e, including risk above tolerance, subcontracting not allowed by the contract, incomplete change notification, missing supplier proof, objection without proof of delivery and exit case with missing decision documentation. Automatic labels such as \u003cstrong\u003e“REVIEW APPLICABILITY”, “COMPLETE CONTRACT”, “OBJECTION ASSESSMENT BEFORE DEADLINE”\u003c\/strong\u003e and \u003cstrong\u003e“EXIT REQUIRES MANUAL DECISION”\u003c\/strong\u003e never mean that legal requirements have been met. The customer file is reset without fictitious test cases.\u003c\/p\u003e\n\n\u003ch2\u003eHow you handle the change in practice\u003c\/h2\u003e\n\n\u003col\u003e\n\n\u003cli\u003e\n\n\u003cstrong\u003eReceive and save the original notification.\u003c\/strong\u003e Capture the actual sender, contract, time of message, new sub-supplier chain and planned implementation date.\u003c\/li\u003e\n\n\u003cli\u003e\n\n\u003cstrong\u003eCheck applicability.\u003c\/strong\u003e Assess DORA entity, critical\/important function, materiality, sub-supplier chain and contractually agreed permission to hire sub-suppliers.\u003c\/li\u003e\n\n\u003cli\u003e\n\n\u003cstrong\u003eVerify notification period.\u003c\/strong\u003e Article 5.2 requires a reasonable contractually agreed period for approval or objection. There is \u003cstrong\u003eno general legal rule of exactly 30 days\u003c\/strong\u003e. Let the responsible person establish the final response time based on the actual contract.\u003c\/li\u003e\n\n\u003cli\u003e\n\n\u003cstrong\u003eAssess the risk of the change.\u003c\/strong\u003e Investigate concentration, continuity, security, data localization, sub-suppliers' resources as well as access, inspection and audit rights.\u003c\/li\u003e\n\n\u003cli\u003e\n\n\u003cstrong\u003eRequest necessary additional information.\u003c\/strong\u003e Ask the main supplier to document the chain and the actual effect of the change. The financial firm retains responsibility even if the supplier has performed its own risk assessment.\u003c\/li\u003e\n\n\u003cli\u003e\n\n\u003cstrong\u003eMake and communicate a competent decision.\u003c\/strong\u003e If the risk exceeds risk appetite\/tolerance, the financial entity shall, according to Article 5.4, inform the supplier, object and request modifications before the end of the period. Save actual proof of sending and receipt.\u003c\/li\u003e\n\n\u003cli\u003e\n\n\u003cstrong\u003eFollow up on implementation and possible exit.\u003c\/strong\u003e Check the actual implementation date. Assess Article 6 and DORA Article 28.7 as well as the own contract before termination or migration.\u003c\/li\u003e\n\n\n\u003c\/ol\u003e\n\n\u003ch2\u003eWhat do DORA and Regulation (EU) 2025\/532 say?\u003c\/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eArticle 3, 2025\/532:\u003c\/strong\u003e the financial entity shall perform relevant assessments of sub-suppliers that support critical or important functions. Relying on the ICT supplier's due diligence does not exempt the company from ultimate responsibility.\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eArticle 4:\u003c\/strong\u003e the contract shall identify which relevant ICT services may be outsourced to sub-suppliers and under what conditions. Any necessary contractual adjustments shall be implemented in time and planned in a documented manner.\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eArticles 5.1–5.3:\u003c\/strong\u003e material changes shall be notified in good time so that the company can assess risk and the supplier's ability to fulfill the contract. A reasonable contractually agreed objection period shall exist. The supplier may implement the change when the financial entity has approved it or has not objected by the end of the period according to the applicable contract and regulations.\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eArticle 5.4:\u003c\/strong\u003e if the change exceeds the established risk tolerance, the company shall \u003cem\u003ebefore the end of the period\u003c\/em\u003e communicate its assessment, object and request changes. This is not the same as a system automatically determining the risk.\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eArticle 6:\u003c\/strong\u003e the contract shall contain termination rights, including if the supplier implements the change despite objection, implements it prematurely without approval or outsources relevant services without the contract expressly allowing it. \u003cstrong\u003eThis is a conditional contractual right – not an automatic rescission.\u003c\/strong\u003e Also check Article 28.7 in DORA.\u003c\/p\u003e\n\n\u003cp\u003ePrimary sources: \u003ca href=\"https:\/\/eur-lex.europa.eu\/legal-content\/SV\/TXT\/?uri=CELEX:32025R0532\"\u003eCommission Delegated Regulation (EU) 2025\/532\u003c\/a\u003e and \u003ca href=\"https:\/\/eur-lex.europa.eu\/legal-content\/SV\/TXT\/?uri=CELEX:32022R2554\"\u003eDORA (EU) 2022\/2554\u003c\/a\u003e. See \u003ca href=\"https:\/\/finance.ec.europa.eu\/regulation-and-supervision\/financial-services-legislation\/implementing-and-delegated-acts\/digital-operational-resilience-regulation_en\"\u003ethe European Commission's list of implementing acts\u003c\/a\u003e.\u003c\/p\u003e\n\n\u003ch2\u003eDifference from Mallbutiken's general DORA package\u003c\/h2\u003e\n\n\u003cp\u003e\u003ca href=\"\/en\/products\/dora-ikt-leverantorsavtal-compliance-mallpaket-2026\"\u003eDORA ICT Supplier Contract \u0026amp; Compliance Template Package 2026\u003c\/a\u003e covers broad contract management and regulatory compliance. \u003cstrong\u003eThis special product solves a more delimited work step:\u003c\/strong\u003e an actually notified change in the sub-supplier chain, with assessment, response within the agreed time, objection and separate exit review. For a general IT change request, there is also \u003ca href=\"\/en\/products\/it-andringsbegaran-andringsstyrning-word-pdf-excel\"\u003eIT Change Request \u0026amp; Change Management\u003c\/a\u003e.\u003c\/p\u003e\n\n\u003ch2\u003eFrequently Asked Questions\u003c\/h2\u003e\n\n\u003ch3\u003eMust all sub-supplier changes be approved under DORA?\u003c\/h3\u003e\n\n\u003cp\u003eNo. These specific rules concern ICT services that support critical or important functions or substantial parts thereof and relevant material changes. Review the actual service, impact and contract.\u003c\/p\u003e\n\n\u003ch3\u003eIs the objection period always 30 days?\u003c\/h3\u003e\n\n\u003cp\u003eNo. The Regulation requires a reasonable notification period in the contract. There is no universally prescribed 30-day period. Such a period only applies if it follows from the relevant contract and is applicable.\u003c\/p\u003e\n\n\u003ch3\u003eWhat do we do if the risk assessment exceeds the risk appetite?\u003c\/h3\u003e\n\n\u003cp\u003eArticle 5.4 states that the company shall inform about its risk assessment, object and request changes before the contractually agreed end of the period. This shall be done by the competent function and documented.\u003c\/p\u003e\n\n\u003ch3\u003eCan we terminate the contract if the change has already been made?\u003c\/h3\u003e\n\n\u003cp\u003eArticle 6 states contract-based termination possibilities in specified situations. Check the contract, actual sequence of events, risk and continuity and let the responsible legal counsel review the measure. Not every implemented change gives an automatic right of termination.\u003c\/p\u003e\n\n\u003ch3\u003eCan the supplier's risk investigation replace ours?\u003c\/h3\u003e\n\n\u003cp\u003eNo. The Regulation states that the financial entity is not exempted from its ultimate responsibility just by relying on the supplier's due diligence.\u003c\/p\u003e\n\n\u003ch3\u003eCan Excel automatically calculate a legally correct objection period?\u003c\/h3\u003e\n\n\u003cp\u003eNo. The workbook records the period that a responsible person has established after contract review; it does not calculate the contractual deadline or approval itself.\u003c\/p\u003e\n\n\u003ch3\u003eAre all documents in English?\u003c\/h3\u003e\n\n\u003cp\u003eNo. Five work templates, a Swedish guide and Excel are in Swedish. A separate English User Guide describes the use, but does not constitute a full translation of the work templates.\u003c\/p\u003e\n\n\u003ch3\u003eAre the PDF files fillable?\u003c\/h3\u003e\n\n\u003cp\u003eNo. They are searchable and printable A4 copies of the Word documents, not PDF forms with interactive fields.\u003c\/p\u003e\n\n\u003ch2\u003eVersion, source control and limitations\u003c\/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eVersion 1.0 – November 9, 2026.\u003c\/strong\u003e Legal source control has been performed with official EU legal acts and technical file review of DOCX, PDF and XLSX. No external lawyer, supervisory authority or independent ICT auditor has reviewed or approved the material. The templates cannot send contract messages, verify a sub-supplier's actual security or approve a termination decision. Use them as administrative documentation for separate expert and competent review.\u003c\/p\u003e\n\n\u003c\/section\u003e","brand":"Svenska Dokumentmallar","offers":[{"title":"Default Title","offer_id":56559609250134,"sku":"MB-DORA-SUBCHANGE-2026-V1","price":79.0,"currency_code":"SEK","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0827\/2373\/3846\/files\/mallbutiken-01_DORA_Underleverantorsbyte_Huvudbild_1600.png?v=1794227970","url":"https:\/\/mallbutiken.se\/en\/products\/dora-ikt-underleverantorsbyte-risk-invandning-exit","provider":"Mallbutiken","version":"1.0","type":"link"}