Law Firms Have Their Own Vendor Risk to Answer For

DORA‘s critical third-party oversight regime applies specifically to financial entities and the ICT providers designated as critical to that sector. Law firms are not directly in scope. The pattern it exposes, however, applies just as much to a firm’s own reliance on cloud and IT vendors: regulatory oversight of a vendor, wherever it exists, never transfers the firm’s own accountability for that relationship.

Some firms watching this development assume that because they are not regulated the same way, the underlying lesson does not apply to them either. That assumption is the mistake this article addresses: concentration risk in a small number of critical vendors is a structural property of relying on those vendors, not a consequence of a specific regulation. A firm can be entirely outside DORA’s scope and still be dangerously exposed to the same failure mode DORA was designed to manage.

Executive Summary

Firms watching frameworks like DORA develop in financial services can draw a direct lesson for their own vendor risk management, even without being in scope themselves: concentration in a small number of critical vendors, and the accountability that concentration creates, does not go away because no external regulator happens to oversee that specific vendor. For risk leads, the practical response is treating vendor concentration as a risk to manage continuously, not a compliance category that only applies to other sectors.

Key Takeaways

1. A vendor being subject to external oversight, regulatory or otherwise, does not transfer a firm’s own accountability for that relationship. The obligation to understand and manage the risk sits with the firm regardless.
2. Firms relying heavily on a small number of cloud or practice-management vendors carry concentration risk regardless of whether any external body oversees those vendors.
3. Regulators and clients increasingly expect continuous evidence of vendor oversight, not a one-time due diligence exercise performed at contract signing.
4. A register of vendor relationships and their criticality is a living record a firm should maintain regardless of sector-specific mandates, because the underlying risk exists independent of the regulation.
5. The firm’s own obligation to prove control over its vendor relationships never moves, whoever else is watching.

What Critical Third-Party Designation Actually Does in Financial Services

Understanding why DORA’s mechanism exists helps clarify why the underlying lesson transfers even where the regulation does not. The designation mechanism gives regulators visibility into providers whose failure could have consequences across many financial entities at once, based on systemic impact and concentration of reliance.

Designation Is About Systemic Concentration, Not Individual Vendor Risk

A provider gets designated as critical because a large number of regulated entities depend on it in ways that could create sector-wide disruption. A firm’s own exposure to a vendor, based on how heavily it actually relies on that vendor and what alternatives exist, is a separate question that no designation mechanism, in any sector, answers on the firm’s behalf.

Why Your Own Accountability Never Moves

Whether or not a regulator directly oversees a vendor, the firm relying on that vendor retains full responsibility for understanding what happens if it fails. This holds regardless of which sector the firm operates in.

External Oversight of a Vendor Is Not Oversight of Your Contract

Even where a vendor is subject to intense regulatory scrutiny in another sector entirely, that scrutiny examines the vendor’s general risk management, not any individual customer’s specific contract, exit plan, or dependency. A firm cannot outsource its own due diligence to a regulator that has never reviewed the firm’s actual relationship with that vendor.

Concentration Risk Exists Independent of Regulatory Scope

A firm that depends on a small number of vendors for practice management, document storage and communications carries the same structural concentration risk a financial institution carries toward its critical ICT providers, whether or not any regulation names that risk explicitly.

What Good Vendor Risk Management Looks Like, Regulated or Not

The practices that make DORA’s third-party risk regime effective for financial entities are the same practices that protect any organisation relying on a small number of critical vendors.

A Register of Vendor Relationships Is a Living Record

Maintaining an accurate account of which vendors support which functions, and how critical each is to the firm’s ability to operate, is worth doing regardless of sector-specific mandate, because the exercise itself is what surfaces concentration risk before it becomes a crisis.

Monitoring Has to Be Continuous, Not a One-Time Exercise

A due diligence exercise performed once at contract signing does not tell a firm anything about a vendor’s current risk posture years later. Continuous monitoring, even informally, is what turns a vendor relationship from an assumption into something actually managed.

Building Vendor Risk Management Before a Regulator Asks You To

The practical response for a firm is to build the same internal capability a regulated financial entity is required to build: a continuously updated view of which vendors are genuinely critical, how concentrated that reliance is, and what evidence exists of ongoing oversight, done because it protects the firm, not because a regulation demands it.

How a Data Control Plane Supports Continuous Vendor Risk Evidence

Demonstrating control over vendor risk depends on being able to show, continuously, what data moves through which vendors and channels, who accessed it, and under what conditions, rather than relying on a vendor’s own assurances or a due diligence exercise performed once.

The Kiteworks Data Control Plane applies data-aware, zero-trust controls to every action across every channel, capturing a continuous, tamper-proof, unthrottled audit log that feeds directly into SIEM tooling, giving firms evidence of their own vendor oversight independent of any external designation regime. Single-tenant architecture and customer-owned encryption keys further mean a firm’s control over its most sensitive exchanges does not depend on any third party’s oversight status.

Firms that want to see how continuous evidence supports their own vendor risk management can schedule a custom demo.