[non-validated] DORA: Critical ICT Third-Party Provider Designation
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented evidence of identifying and designating its critical ICT third-party providers as required by DORA Article 2?
Explanation
[non-validated] Determines whether the financial entity has documented evidence identifying and formally designating its critical ICT third-party providers, as outlined in repository source materials based on DORA Article 2 requirements.
Criterion and evidence
Verify financial entity (per repository definition) maintains documented identification and formal designation of critical ICT third-party providers under referenced DORA provisions. Evidence period: ongoing compliance assessment. Pass: documented criticality assessments with impact analysis exist; Fail: no documentation provided; Pending: evidence not submitted during assessment period.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Applicability, proportionality and governance. Identify the assessed legal entity, its DORA role, applicable regime and management-body accountability. Determine financial-entity category, exemptions, group boundary, size and proportionality; distinguish the standard and simplified ICT frameworks and the role of non-critical versus designated critical ICT providers. Cover management-body ownership, resourcing and ICT-risk oversight. Do not treat every provider as directly subject to every financial-entity obligation. DORA article references: 1, 2, 3, 4, 5, 16. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient documented evidence for critical provider designation?
Documented assessments showing formal identification of critical ICT third-party providers with impact analysis per entity's risk framework, as referenced in repository source passages. Excluded: verbal assertions without written records.
Are alternatives accepted where documentation is incomplete?
No valid alternatives satisfy this criterion per repository documentation; DORA Article 2 explicitly requires financial entities to identify and designate critical ICT third-party providers with no substitutable approaches.
References
DORA: Applicability, proportionality and governance