Preparing for a DORA Joint Examination Team Visit as a Critical ICT Third Party

The oversight regime built for the cloud hyperscalers now has names attached to it, and the first Joint Examination Teams are being assembled. If you are on the list, the question is no longer whether you will be inspected but what the team finds when it arrives.

On 18 November 2025 the European Supervisory Authorities published the first list of critical ICT third-party providers under DORA: nineteen firms, including the large cloud and enterprise-software providers you would expect. For the entities on that list, the abstraction ends. They move from being a supplier that financial entities have to manage into being a party the European supervisors oversee directly, through a Lead Overseer and an instrument called the Joint Examination Team. Most of the material written for newly designated providers is written by people who have never sat opposite a supervisor. This is a reading of what the team is actually mandated to look at, and what it will ask you to produce on the day.

What a Joint Examination Team actually is

The Joint Examination Team, or JET, is the operational vehicle for DORA oversight of a critical provider. It is directed by the Lead Overseer, with a Lead Overseer coordinator running the day-to-day, and it is staffed not only by ESA personnel but by the competent authorities that supervise the financial entities you serve, plus national authorities on a voluntary basis. Every member is required to have expertise in ICT matters and in operational risk. This is not a paperwork audit run by generalists; it is a mixed team of people who understand both the supervisory obligation and the technology underneath it.

The JET conducts the general investigations and inspections that DORA provides for. When it finishes, the Lead Overseer has three months to adopt recommendations addressed to you and to communicate them to the authorities supervising your financial-entity clients. Those recommendations are not private. They land with the regulators of every bank, insurer and investment firm that depends on you, and they shape how those firms are expected to treat the arrangement thereafter. The point that designated providers underestimate is that the output of a JET visit propagates outward through your entire client base. We have written before about how designation reads from both sides of the relationship; the JET is where the provider side becomes concrete.

What the team is mandated to assess

DORA does not leave the scope of the assessment vague. The Lead Overseer is directed to evaluate a defined list, and the JET works to it. The headline areas are:

• The security, availability, continuity, scalability and quality of the services you provide, and how you maintain the authenticity, integrity and confidentiality of data.
• The physical security of the premises, facilities and data centres that support those services.
• Your ICT risk-management policies, business-continuity arrangements and incident response and recovery.
• Your governance: whether accountability for ICT risk is transparent and actually sits somewhere.
• The identification, monitoring and prompt reporting of material ICT incidents to the financial entities affected.
• The mechanisms for data portability and interoperability that let a financial entity exit and move without stranding itself.
• Your testing of ICT systems and controls, your own audit practices, and your application of the relevant national and international standards.

Read that list as an engineer, not a compliance officer. Every item is checkable against operational reality. “We test our controls” is a representation; the test schedules, scope documents and remediation records are the evidence. The examination exists precisely to compare the second against the first, and the gap between them is what a JET is trained to find.

The dossier: assemble it before, not during

The single most expensive mistake is treating the visit as the moment to gather evidence rather than to present it. Four bodies of material carry the weight. First, resilience-testing records: what you tested, the scope, when, what failed, and what you did about it, with the closure trail intact. A test that surfaced a serious weakness and shows it fixed is worth more than a clean report nobody can reconstruct. Second, incident history: a coherent record of material incidents, how they were classified, and how and when the affected financial entities were told, mapped against the timelines you contractually promised them. Third, subcontracting transparency, covered below. Fourth, governance evidence: who owns ICT risk, the committee minutes where it was reviewed, and proof that the ownership is real rather than an organisation chart.

This is the same discipline the financial entities on the other side have been building into their self-assessment and incident pipeline. The difference is that as a designated provider you are now assembling it for a supervisor who can inspect the underlying systems, not just read the summary. Rehearse the walkthrough. A team that can produce the artefact, explain it, and show it connecting to the next artefact is telling a coherent story. One that produces a document but cannot show it operating is demonstrating stated compliance without evidence of practice, and DORA oversight is explicitly built to catch the second.

Subcontracting is where the paper falls apart

The recommendation power reaches directly into your supply chain. The Lead Overseer can make recommendations on the conditions of your subcontracting arrangements, including restrictions on subcontracting where the subcontractor sits in a third country. If you cannot produce a clear map of your fourth parties, the functions they support, and where they run, you have handed the team its first finding. This is the layer designated providers most often cannot render on demand, because subcontracting chains grow organically and nobody owns the full picture. Map it before the JET does it for you, and understand which links support the critical or important functions of your financial-entity clients, because those are the ones that will draw the closest look. Our note on what designation means in practice goes further into how this obligation cascades.

The powers, and the cost of stonewalling

The Lead Overseer can request all relevant information and documentation, conduct general investigations and on-site inspections, require reports on the remedial action you have taken, and issue recommendations on ICT security, service conditions and subcontracting. Where a provider does not comply with an information request, investigation or reporting demand, the Lead Overseer can impose a periodic penalty payment of up to 1% of average daily worldwide turnover from the preceding business year, levied daily and capable of running for up to six months, after at least thirty calendar days’ notice. The direct fine is one thing. The larger exposure is that your financial-entity clients can be required by their own supervisors to suspend or terminate arrangements that oversight has flagged as unsafe, and that consequence sits alongside the oversight fee you already carry for the privilege of being supervised.

Oversight under DORA is intrusive and evidence-led by design. The team tests what you do against what you have said you do, and a gap surfaced live in front of a Joint Examination Team is far more expensive than the same gap found, and closed, in your own dry run first.

Sixteen Pillars is a technology governance consultancy based in Cyprus. Engagements run remote across the EU, UK, and Middle East, with on-site time where the engagement requires it.