[non-validated] DORA SFS D / SF 2: Concentration Risk Management
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated financial entity implemented documented concentration risk assessment and monitoring measures for critical ICT third-party services as required by DORA Articles 28-29?
Explanation
[non-validated] Has the designated financial entity implemented documented concentration risk assessment and monitoring measures for critical ICT third-party services as required by DORA Articles 28-29?
Criterion and evidence
Verify documented concentration risk management methodology and monitoring mechanisms for critical dependencies under DORA Articles 28-29, applicable to designated financial entities during the supervisory review period.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT third-party risk, concentration and register. Govern ICT provider arrangements, due diligence, concentration risk and the register of information. Cover third-party strategy, accountable ownership, pre-contract assessment, provider selection, conflicts, concentration and the entity/group register with applicable submissions. SFS E owns contractual clauses, subcontracting and exits; SFS F owns designated-provider oversight interactions. DORA article references: 28, 29. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence satisfies this requirement?
Documented concentration risk assessment methodology showing identification of single-provider dependencies for critical ICT services, and evidence of active monitoring mechanisms per DORA Articles 28-29 repository boundaries. Generic vendor management policies without specific concentration risk provisions are insufficient.
How is non-applicability handled?
Non-applicability must be explicitly scoped out based on entity role (only applicable to designated financial entities under DORA). Absence of documented procedures results in pending determination, not automatic failure. No valid alternatives waive the requirement.
References
DORA: ICT third-party risk, concentration and register