[non-validated] DORA SFS D / SF A: Third-Party Strategy Accountability Oversight
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented its ICT third-party risk management strategy, including strategic oversight mechanisms as required by DORA Articles 28-29?
Explanation
[non-validated] Has the entity documented a third-party risk management strategy with accountable ownership and strategic oversight as required under DORA Articles 28-29?
Criterion and evidence
Assess documented third-party risk strategy by designated financial entities under DORA scope (Regulation (EU) 2022/2554, Articles 28-29) during current review period. Positive evidence requires documented strategy showing accountable ownership framework per repository description; negative when no such documentation exists; pending when evidence unavailable despite documented search within pinned repository documentation.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT third-party risk, concentration and register. Govern ICT provider arrangements, due diligence, concentration risk and the register of information. Cover third-party strategy, accountable ownership, pre-contract assessment, provider selection, conflicts, concentration and the entity/group register with applicable submissions. SFS E owns contractual clauses, subcontracting and exits; SFS F owns designated-provider oversight interactions. DORA article references: 28, 29. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence?
Documented strategy showing accountable ownership framework and strategic oversight mechanisms (e.g., ownership assignments, oversight processes) per repository topic boundaries description; implementation alternatives are not verified in frozen repository passages.
How is missing evidence handled?
Pending determination when evidence is unavailable despite documented search efforts within pinned repository documentation constraints; no automatic negative outcome per missing evidence handling rules.
References
DORA: ICT third-party risk, concentration and register