[non-validated] DORA SFS D / SF 0: ICT Third-Party Risk Management
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity implemented documented procedures for assessing and managing ICT third-party risk, including due diligence assessments, concentration risk controls, and maintaining a register of information as specified in DORA Articles 28-29?
Explanation
[non-validated] Has the entity implemented documented procedures for assessing and managing ICT third-party risk, including due diligence assessments, concentration risk controls, and maintaining a register of information as specified in DORA Articles 28-29?
Criterion and evidence
Applies to designated financial entities and ICT service providers under DORA scope. Requires documented evidence of third-party risk assessment methodology, due diligence processes for provider selection, concentration risk management measures, and an up-to-date register of ICT arrangements during the current review period. Missing evidence remains pending.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT third-party risk, concentration and register. Govern ICT provider arrangements, due diligence, concentration risk and the register of information. Cover third-party strategy, accountable ownership, pre-contract assessment, provider selection, conflicts, concentration and the entity/group register with applicable submissions. SFS E owns contractual clauses, subcontracting and exits; SFS F owns designated-provider oversight interactions. DORA article references: 28, 29. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for compliance?
Documented procedures explicitly covering pre-contract assessments, concentration risk monitoring, and the entity/group register of ICT arrangements per DORA Articles 28-29. Generic vendor management policies without DORA-specific concentration risk measures and register requirements are insufficient. Absence of documentation results in a pending determination awaiting evidence.
References
DORA: ICT third-party risk, concentration and register