[non-validated] DORA: Documentation of subcontracting arrangements in ICT third-party risk register (Article 28)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented subcontracting arrangements for all ICT third-party providers within its risk register as required by DORA Article 28?
Explanation
[non-validated] Does the entity maintain documented evidence that subcontracting arrangements for all ICT third-party providers are included in the ICT risk register, as mandated by DORA Article 28(2)?
Criterion and evidence
Applies to designated financial entities under DORA scope. Requires documented evidence in the ICT third-party risk register showing subcontracting arrangements for all ICT providers per DORA Article 28(2) during the current review period. Absence of documentation constitutes failure; pending if evidence unavailable despite documented search within repository constraints.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT third-party risk, concentration and register. Govern ICT provider arrangements, due diligence, concentration risk and the register of information. Cover third-party strategy, accountable ownership, pre-contract assessment, provider selection, conflicts, concentration and the entity/group register with applicable submissions. SFS E owns contractual clauses, subcontracting and exits; SFS F owns designated-provider oversight interactions. DORA article references: 28, 29. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What qualifies as sufficient evidence for this requirement?
Documented entries in the ICT third-party risk register explicitly showing subcontracting relationships and hierarchical dependencies as required by DORA Article 28(2). Examples include register entries that map subcontracted services to critical ICT arrangements.
Are there valid alternatives to documented register entries?
No valid alternatives exist; DORA Article 28(2) explicitly mandates inclusion of subcontracting arrangements in the ICT third-party risk register without permissible substitutions.
References
DORA: ICT third-party risk, concentration and register