[non-validated] DORA SFS A / SF B: Provider Participation Determination
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Selected updates are pending because supporting source research is incomplete. The existing catalog content is shown below.
Question
[non-validated] Has the applicable entity documented its determination of whether provider participation in information sharing arrangements is required based on its DORA critical provider classification as specified in the area description?
Explanation
[non-validated] Has the applicable entity documented its determination of whether provider participation in information sharing arrangements is required based on its DORA critical provider classification?
Criterion and evidence
Verify designated entity's role classification under Regulation (EU) 2022/2554. Evidence must confirm documented determination of provider participation obligation per criticality status during current review period, referencing Articles 13 and 45. Non-participation is acceptable when outside specified scope per area description's conditionality boundary.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Learning, staff readiness and information sharing. Use incident/test lessons, staff readiness and controlled information sharing to improve resilience. Cover post-incident learning, training and awareness for staff and management, relevant provider participation, intelligence sharing arrangements and applicable authority notifications. Sharing participation is conditional; non-participation is not automatically a statutory failure. SFS 1 owns framework assurance. DORA article references: 13, 45. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for compliance?
Documented determination records (e.g., internal audit reports, classification assessments) showing entity verified its DORA critical provider status and resulting participation obligations. Regulatory notices citing absence of documentation constitute failure.
How are conditional participation requirements evaluated?
Non-participation is acceptable only when explicitly outside scope defined by entity's classification status per area description boundary condition. Evidence must demonstrate this determination was formally documented rather than assumed.
References
DORA: Learning, staff readiness and information sharing