Glossary

DORA

The Digital Operational Resilience Act (Regulation (EU) 2022/2554). Pillar IV governs ICT third-party risk - the scope tprm.mlab.sh implements.

TPRM

Third-Party Risk Management. The discipline of identifying, assessing and monitoring risk arising from external service providers.

ICT third-party service provider

An undertaking providing ICT services to a financial entity. Each one is recorded as a provider and feeds template B_05.01.

LEI

Legal Entity Identifier (ISO 17442) - a 20-character code uniquely identifying a legal entity. Mandatory for the reporting entity and used throughout the register.

EBA ITS

The European Banking Authority's Implementing Technical Standards. They define the register's structure: 15 templates (B_01.01 ... B_99.01) under Reporting Framework 4.0.

Register of information

The consolidated record of all ICT third-party contractual arrangements required by DORA Article 28(3). tprm.mlab.sh builds it from every module.

xBRL-CSV

The CSV-based variant of the xBRL reporting standard. The deposit package wraps the 15 CSVs with the official taxonomy metadata into a single .zip.

Controlled (EBA) code

An enumerated value from a DORA 4.0 vocabulary (eba_CT, eba_TA, eba_GA, eba_CU, etc.). Selected in the UI, emitted on export.

Concentration risk

Over-dependence on a small number of providers, categories or geographies. Assessed per provider under Article 29 (critical functions, substitutability, related companies, third countries, subcontracting chains, CTPP designation), and by category and country with thresholds (>50% high, >30% medium).

RTO / RPO

Recovery Time Objective and Recovery Point Objective - how quickly a function must recover and how much data loss is tolerable. Captured per business function.

Exit strategy

A documented plan to wind down or substitute a critical ICT dependency, including test dates and versioning. Required under Article 30 for critical/important functions.

Subcontracting chain

The cascade of subcontractors behind a direct provider, ranked by tier (rank 1 = direct, rank 2+ = indirect). Mapped in template B_05.02.

Critical / important function

A function whose disruption would materially impair the financial entity's operations or regulatory compliance. Drives the Art. 30(3) clause requirements.

Article 28

DORA's general principles for ICT third-party risk - including due diligence (28(4)), audit rights (28(5-6)) and the register of information (28(3)).

Article 30

DORA's mandatory contractual provisions. 30(2) clauses apply to all contracts; 30(3) clauses add requirements for critical/important functions.

Due diligence

The pre-contractual assessment of a prospective provider (criticality, supervision, concentration, security, continuity, exit) under Article 28(4).

Roles

tprm.mlab.sh has two roles: administrator (everything, including team, settings, single sign-on and API keys) and member (all of the organisation's data).

CTPP

Critical ICT third-party service provider: a provider designated by the European Supervisory Authorities under DORA Article 31 and overseen directly by a Lead Overseer. Under Article 42 a competent authority may require financial entities to suspend or terminate their use of a CTPP's services.

RTS 2025/532

Commission Delegated Regulation (EU) 2025/532, on subcontracting ICT services that support critical or important functions: conditions to assess before allowing it (Art. 3), contract clauses (Art. 4), and material changes with their notice and termination rights (Art. 5-6).

Major ICT-related incident

An incident that meets the criteria and thresholds of Delegated Regulation (EU) 2024/1772. It must be reported to the competent authority in three steps (initial notification, intermediate report, final report) within the deadlines of Delegated Regulation (EU) 2025/301.

Supervisory conditions

Under Article 28(4)(b), a financial entity checks before contracting that nothing in the arrangement would prevent its competent authority from supervising it: access and audit rights, third-country law, a CTPP's EU subsidiary, measures under Article 42.

Processor and sub-processor (GDPR)

A processor handles personal data on your behalf under a written agreement (GDPR Art. 28); a sub-processor is a processor it engages in turn, with your prior authorisation.

Fourth party

A provider of your provider: a subcontractor further down the chain. The supply chain (B_05.02) records them; the public footprint scan suggests some from public data.

OpenID Connect (OIDC)

The sign-in protocol on top of OAuth 2.0 that single sign-on uses with Microsoft Entra ID, Okta, Google or Keycloak.

Kept license

The signed license an instance stores in its database. It is valid for 7 days, so the platform keeps running across restarts and while mlab.sh is unreachable. See Licensing.

Place

A slot on a license held by one running instance. A license has 1 place unless the contract says otherwise; an instance silent for 3 hours gives its place back. See Places.