[non-validated] DORA SFS D / SF C: Group-level ICT Third-Party Risk Register
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity maintained a consolidated ICT third-party risk register at the group level where applicable under DORA repository topic boundaries governing entity/group register requirements?
Explanation
[non-validated] Does the designated financial entity within a corporate group maintain a consolidated ICT third-party risk register covering all subsidiaries, as required by DORA Articles 28-29?
Criterion and evidence
Applies to designated financial entities within a corporate group under DORA Arts. 28-29. Requires documented evidence of consolidated ICT third-party risk register covering all subsidiaries, including risk assessments and contractual arrangements during current review period. Excludes standalone entities. Missing evidence results in pending determination despite documented search within repository constraints.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT third-party risk, concentration and register. Govern ICT provider arrangements, due diligence, concentration risk and the register of information. Cover third-party strategy, accountable ownership, pre-contract assessment, provider selection, conflicts, concentration and the entity/group register with applicable submissions. SFS E owns contractual clauses, subcontracting and exits; SFS F owns designated-provider oversight interactions. DORA article references: 28, 29. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for group-level register maintenance?
Documented register covering all subsidiaries with supervisory authority approval per repository scope boundaries. Requires demonstration of consolidated oversight where entity belongs to corporate group (keyDescription passage).
How are missing records handled?
Pending determination when evidence unavailable despite documented search within repository constraints. Absence of group-level register where required constitutes failure per repository topic boundaries.
References
DORA: ICT third-party risk, concentration and register