As of January 2025, DORA mandates that financial institutions implement systematic ICT risk management across their entire supply chain with over 350 requirements and requires software-based third-party management processes.