DORA requires full vendor lifecycle management, including pre-contractual assessments, ongoing monitoring, and robust exit strategies for third-party vendors. Critical third-party ICT service providers must adhere to DORA compliance, which includes audit and security requirements, to mitigate supply chain risks.