[non-validated] DORA SFS 2 / SF D: ICT Third-Party Regulatory Register (Repository Allocation)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity maintained a documented regulatory register of all ICT third-party arrangements supporting critical functions as specified in the repository's DORA profile allocation?
Explanation
[non-validated] Per the repository's DORA profile allocation, has the financial entity maintained a documented regulatory register of all ICT third-party arrangements supporting critical functions?
Criterion and evidence
Repository allocation designates SFS D to cover maintenance of the regulatory register for ICT third-party arrangements supporting critical functions (referencing DORA Articles 7 and 8). Verification requires documented coverage during the oversight cycle per repository definition. Missing documentation results in pending verification status; no alternatives satisfy the criterion.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT assets, services and dependency mapping. Identify critical functions and the assets, information and dependencies that support them. Cover business-function classification, inventories, ownership, dependency maps, ICT adequacy and legacy-system risk assessment. SFS D owns third-party arrangements and the regulatory register; SFS 4 owns changes and vulnerabilities. DORA article references: 7, 8. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence per repository allocation?
Documented evidence explicitly showing the regulatory register covers all ICT third-party arrangements supporting critical functions as defined in repository allocation (keyDescription), with coverage aligned to business impact analysis outcomes.
How are critical functions determined in this context?
Per repository allocation (keyDescription), critical functions are those whose disruption would severely impact business operations, identified through the entity's risk management framework as referenced in keyShortInfo.
References
DORA: ICT assets, services and dependency mapping