August 2026. DORA requires financial entities and critical ICT vendors to document exit strategies and data migration. ICT providers to banks and insurers increasingly face exit plans in due diligence.
What to document?
- exit scenarios: contract termination, vendor insolvency, force majeure;
- data migration: format, timing, export test;
- continuity: transition to alternative within RTO;
- contract clauses: exit assistance, escrow if relevant.
Practice for ICT vendors
Record runbooks and test annual export of customer data (sandbox). Link to DORA hub and vendor management. ISO 27001 BCM and vendor controls support DORA exit — one register where possible.
In 2026 exit plans without test date are weak evidence. Plan tabletop: vendor insolvency + 30-day migration.