[non-validated] DORA SFS A / SF E: Documented selection criteria for information sharing provider selection
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Selected updates are pending because supporting source research is incomplete. The existing catalog content is shown below.
Question
[non-validated] Has the applicable entity documented selection criteria for relevant providers in information sharing arrangements as required by the DORA area description for its classification?
Explanation
[non-validated] Has the applicable entity documented selection criteria for relevant providers in information sharing arrangements, as required by Regulation (EU) 2022/2554 Articles 13 and 45 based on their DORA classification?
Criterion and evidence
Verify documented selection criteria for relevant providers in information sharing arrangements per entity's specific Regulation (EU) 2022/2554 classification under Articles 13/45, acknowledging conditional participation requirements and evidence period alignment with current regulatory review period.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Learning, staff readiness and information sharing. Use incident/test lessons, staff readiness and controlled information sharing to improve resilience. Cover post-incident learning, training and awareness for staff and management, relevant provider participation, intelligence sharing arrangements and applicable authority notifications. Sharing participation is conditional; non-participation is not automatically a statutory failure. SFS 1 owns framework assurance. DORA article references: 13, 45. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes 'relevant providers' under Regulation (EU) 2022/2554?
Relevant providers are entities participating in information sharing arrangements mandated by the entity's DORA classification according to Article 13's conditional participation clause; non-participation is permitted where outside explicit scope boundaries.
How is compliance with documented selection criteria evidenced?
Through formal documentation showing defined criteria for selecting providers in information sharing arrangements, including sectoral CERT participation requirements and risk assessment standards. Absence of documentation constitutes failure despite Article 13's conditional participation allowances.
References
DORA: Learning, staff readiness and information sharing