[non-validated] DORA SFS 0 / SF A: Critical ICT Third-Party Risk Management Framework Compliance
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity implemented documented procedures to identify and manage risks from critical ICT third-party providers according to repository-specified DORA framework requirements?
Explanation
[non-validated] Has the financial entity implemented documented mechanisms to assess and manage risks from critical ICT third-party providers as specified in repository-sourced DORA framework requirements, considering its size, risk profile, and operational complexity?
Criterion and evidence
Verify financial entity compliance with repository-specified DORA framework requirements regarding ICT risk management. Assessment must distinguish between standard and simplified frameworks based on proportionality (entity size/risk profile), confirm management body accountability for oversight, and validate documented methodologies identifying critical ICT third-party providers. Evidence period: ongoing assessment. Pass condition: documented procedures explicitly addressing critical provider identification, impact analysis, and management oversight per repository requirements.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Applicability, proportionality and governance. Identify the assessed legal entity, its DORA role, applicable regime and management-body accountability. Determine financial-entity category, exemptions, group boundary, size and proportionality; distinguish the standard and simplified ICT frameworks and the role of non-critical versus designated critical ICT providers. Cover management-body ownership, resourcing and ICT-risk oversight. Do not treat every provider as directly subject to every financial-entity obligation. DORA article references: 1, 2, 3, 4, 5, 16. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence demonstrates compliance with critical ICT third-party risk assessment requirements?
Valid evidence includes documented risk assessment methodologies specifying criteria from repository sources, records showing periodic evaluations of critical providers with impact analysis, and evidence of management body oversight. For simplified frameworks, microenterprise exemptions must align with repository-specified justification standards.
How are 'critical' versus 'non-critical' ICT third-party providers distinguished?
Critical providers are those whose failure could materially disrupt financial entity services. Documentation must show explicit criteria aligned with repository-specified definitions, including service impact analysis. Absence of documented criteria or failure to identify critical providers constitutes non-compliance.
References
DORA: Applicability, proportionality and governance