[non-validated] DORA SFS 8 / SF 4: Third-Party Dependency Continuity Arrangements
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented and tested business continuity arrangements addressing dependencies on critical third-party ICT services during disruptive scenarios as required by DORA Article 11?
Explanation
[non-validated] Supporting fields await model review. Proposed positive criterion: Documented evidence of continuity arrangements explicitly addressing critical third-party ICT dependencies with tested failure response procedures per repository topic boundaries
Criterion and evidence
Actor: Financial entities designated under Regulation (EU) 2022/2554 excluding entities under simplified regime per Article 61. Scope: ICT business continuity arrangements addressing dependencies on critical third-party services for continuity during disruptive scenarios per repository topic boundaries (keyDescription). Evidence period: Current operational cycle corresponding to most recent review period. Required evidence: Documented identification of critical third-party ICT dependencies in continuity planning; Tested procedures demonstrating response to dependency failures. Negative criterion: Absence of documented procedures addressing dependency failures. Missing evidence: Pending verification when continuity arrangements documentation is unavailable. Alternatives: Entities under simplified regime (Article 61) may implement proportionate arrangements addressing only designated critical dependencies
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT business continuity and crisis response. Maintain and test continuity and response arrangements for critical functions and disruptive scenarios. Cover business impact analysis, continuity policy, response/recovery plans, crisis management, activation, dependencies and continuity exercises. SFS 9 owns backup/restore controls; SFS B owns the wider resilience test programme. DORA article references: 11. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What qualifies as sufficient evidence of dependency coverage?
Documented continuity arrangements must explicitly identify critical third-party ICT dependencies per repository topic boundaries. Tested procedures must demonstrate response to dependency failure scenarios during disruptive events within current operational cycle.
How are missing or contradictory records handled?
Absence of documented procedures addressing dependency failures constitutes failure. Pending verification status applies when continuity arrangements documentation is unavailable. Contradictory records require resolution per evidence period cutoff.
References
DORA: ICT business continuity and crisis response