[non-validated] DORA SFS 2 / SF 3: ICT Third-Party Support End-Date Monitoring
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented and monitored end-dates for ICT third-party support services related to critical systems during the review period as required by DORA Article 8?
Explanation
[non-validated] Has the financial entity monitored end-dates for ICT third-party support services related to critical systems during the review period, as required by DORA Article 8?
Criterion and evidence
Financial entities must maintain documented evidence from the regulatory register (SFS D) demonstrating monitored end-dates for all ICT third-party support services supporting critical functions per DORA Article 8. Verification requires evidence covering all critical-system dependencies; absence of documentation results in pending status with no valid alternatives.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT assets, services and dependency mapping. Identify critical functions and the assets, information and dependencies that support them. Cover business-function classification, inventories, ownership, dependency maps, ICT adequacy and legacy-system risk assessment. SFS D owns third-party arrangements and the regulatory register; SFS 4 owns changes and vulnerabilities. DORA article references: 7, 8. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this requirement?
Official documentation from the regulatory register maintained under SFS D demonstrating monitored end-dates for all ICT third-party support services related to critical systems. Evidence must explicitly cover critical dependencies; partial coverage (e.g., non-critical systems only) fails the requirement. Missing documentation results in pending status.
References
DORA: ICT assets, services and dependency mapping