[non-validated] DORA SFS D / SF 1: ICT Third-Party Risk Register with Criticality Designations
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity maintained an up-to-date register documenting all ICT third-party arrangements with risk classifications and critical/non-critical designations as required by DORA Articles 28-29?
Explanation
[non-validated] Does the entity maintain an up-to-date register documenting all ICT third-party arrangements with risk classifications and critical/non-critical designations as required by DORA Articles 28-29?
Criterion and evidence
Verify documented register covering all ICT third-party arrangements per DORA Articles 28-29 including risk classifications and criticality designations. Applies to designated financial entities under DORA scope during current supervisory review period. Positive: verified documentation; Negative: absence of required records; Pending: evidence unavailable despite documented search within repository constraints.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT third-party risk, concentration and register. Govern ICT provider arrangements, due diligence, concentration risk and the register of information. Cover third-party strategy, accountable ownership, pre-contract assessment, provider selection, conflicts, concentration and the entity/group register with applicable submissions. SFS E owns contractual clauses, subcontracting and exits; SFS F owns designated-provider oversight interactions. DORA article references: 28, 29. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence?
Documented register showing all ICT third-party arrangements with updated risk classifications and critical/non-critical designations per DORA Articles 28-29. Evidence must demonstrate current maintenance within review period through verifiable records.
Are alternatives acceptable?
No valid alternatives satisfy this requirement; DORA Articles 28-29 mandate specific register content through repository-defined boundaries. Missing evidence remains pending rather than constituting an automatic pass/fail.
References
DORA: ICT third-party risk, concentration and register