[non-validated] DORA SFS D / SF 3: Pre-contract assessment for critical ICT providers
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated entity documented pre-contract assessment procedures evaluating critical ICT third-party provider suitability and resilience as mandated by DORA Articles 28-29?
Explanation
[non-validated] Has the designated financial entity documented evidence of completed pre-contract assessments evaluating critical ICT third-party provider suitability and resilience as required by DORA Articles 28-29?
Criterion and evidence
Actor: Designated financial entities under DORA scope. Scope: Pre-contract assessment procedures for critical ICT third-party providers prior to onboarding. Evidence period: Current review period defined by supervisory authority. Required evidence: Written pre-contract assessment methodology identifying critical service dependencies; Documented evidence of completed pre-contract evaluations for critical ICT service providers. Negative criterion: Absence of required documentation showing non-compliance. Missing evidence: Pending determination despite documented search efforts within repository-prose boundaries. Alternatives: No valid alternatives; DORA Articles 28-29 prescribe mandatory procedures.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT third-party risk, concentration and register. Govern ICT provider arrangements, due diligence, concentration risk and the register of information. Cover third-party strategy, accountable ownership, pre-contract assessment, provider selection, conflicts, concentration and the entity/group register with applicable submissions. SFS E owns contractual clauses, subcontracting and exits; SFS F owns designated-provider oversight interactions. DORA article references: 28, 29. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this requirement?
Documented pre-contract assessment protocol demonstrating critical service dependency evaluation and resilience testing per DORA Articles 28-29 repository scope boundaries. Generic checklists without DORA-specific resilience assessments are insufficient.
How are missing evidence cases handled?
Pending determination when documented search efforts confirm absence of required evidence within repository-prose boundaries. Absence alone does not constitute automatic failure; documented search logs must exist.
References
DORA: ICT third-party risk, concentration and register