[non-validated] DORA SFS D / SF 9: Pre-contract ICT Third-Party Critical Service Assessment
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated financial entity documented formal pre-contract assessment procedures for ICT third-party providers that specifically identify critical services and evaluate associated risk exposure as required under DORA Article 28?
Explanation
[non-validated] Has the designated financial entity documented formal pre-contract assessment procedures for ICT third-party providers that specifically identify critical services and evaluate risk exposure as required under DORA Article 28?
Criterion and evidence
Verify documented pre-contract assessment procedures meeting DORA Article 28 requirements for designated financial entities. Evidence must demonstrate critical service identification and risk evaluation during provider selection within current review period. Absence of documented procedures constitutes failure; pending determination when evidence unavailable despite documented search within repository-prose boundaries.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT third-party risk, concentration and register. Govern ICT provider arrangements, due diligence, concentration risk and the register of information. Cover third-party strategy, accountable ownership, pre-contract assessment, provider selection, conflicts, concentration and the entity/group register with applicable submissions. SFS E owns contractual clauses, subcontracting and exits; SFS F owns designated-provider oversight interactions. DORA article references: 28, 29. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes acceptable evidence for this requirement?
Documented procedures demonstrating active identification of critical ICT services and systematic risk evaluation during pre-contract phase. Acceptable evidence includes approved assessment frameworks, completed risk templates, and approval records showing methodology application specific to critical dependencies. Generic vendor selection policies without critical service focus are insufficient per repository topic boundaries.
How should missing evidence be handled?
Documented search efforts for governance records showing assessment procedures must be demonstrated within repository constraints. Absence despite documented search results in pending determination. Incomplete evidence (e.g., draft documents) remains pending until finalized documentation exists per keyDescription passage.
References
DORA: ICT third-party risk, concentration and register