On May 26, 2023, the European Supervisory Authorities (ESAs) presented a discussion paper on two delegated acts from DORA to establish further criteria for critical ICT third party providers and to determine the regulatory fees to be charged by these providers. In principle, the quantitative and qualitative criteria/indicators described are suitable as uniform standards for the classification of the criticality of ICT service providers by the ESAs. However, it should be made clearer how the criteria for determining critical ICT service providers will be used in the further process.
