[non-validated] DORA SFS D / SF E: Contractual Clauses for ICT Third-Party Subcontracting and Exits
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented contractual clauses covering subcontracting arrangements and exit procedures for ICT third-party providers as specified in repository topic boundaries?
Explanation
[non-validated] Has the entity documented contractual clauses addressing subcontracting oversight and exit procedures for ICT third-party providers as defined in repository topic boundaries?
Criterion and evidence
Applies to financial entities and designated critical ICT providers per repository topic boundaries. Condition requires documented evidence of contractual clauses explicitly covering subcontractor management protocols and exit procedures (including termination/data migration) during current review period. Positive: Documented clauses meeting repository description; Negative: Absence of required documentation; Pending: Evidence unavailable despite documented search within repository constraints. No valid alternatives satisfy this requirement.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT third-party risk, concentration and register. Govern ICT provider arrangements, due diligence, concentration risk and the register of information. Cover third-party strategy, accountable ownership, pre-contract assessment, provider selection, conflicts, concentration and the entity/group register with applicable submissions. SFS E owns contractual clauses, subcontracting and exits; SFS F owns designated-provider oversight interactions. DORA article references: 28, 29. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
Which entity types require documented contractual clauses for subcontracting and exit procedures?
Applies exclusively to financial entities and designated critical ICT providers as defined in repository topic boundaries. Entity scope follows repository-prose definitions without external legal verification.
What evidence validates compliance with this requirement?
Documented contractual clauses meeting repository topic boundaries: explicit subcontractor oversight protocols (fixture-00DE-1) and exit procedures including termination/data migration steps. Absence constitutes failure (fixture-00DE-2); documented search without findings remains pending (fixture-00DE-3). No alternatives satisfy this requirement.
References
DORA: ICT third-party risk, concentration and register