[non-validated] DORA SFS D / SF F: Designated Critical ICT Third-Party Provider Oversight
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity established documented oversight interactions for designated critical ICT third-party providers as specified in repository topic boundaries covering DORA Articles 28-29?
Explanation
[non-validated] Has the entity established documented oversight interactions for designated critical ICT third-party providers as specified in repository topic boundaries covering DORA Articles 28-29?
Criterion and evidence
Verify documented evidence of oversight interactions for designated critical ICT third-party providers per repository topic boundaries (keyDescription passage), applicable to financial entities under DORA scope with evidence period matching review cycle.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT third-party risk, concentration and register. Govern ICT provider arrangements, due diligence, concentration risk and the register of information. Cover third-party strategy, accountable ownership, pre-contract assessment, provider selection, conflicts, concentration and the entity/group register with applicable submissions. SFS E owns contractual clauses, subcontracting and exits; SFS F owns designated-provider oversight interactions. DORA article references: 28, 29. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for oversight interactions?
Documented oversight interactions for designated critical ICT third-party providers as mandated in repository topic boundaries (keyDescription passage). Absence of documented evidence results in negative assessment per contract.negative.
Are there valid alternatives to documented oversight interactions?
No valid alternatives satisfy this requirement per repository topic boundaries; SFS F explicitly mandates 'designated-provider oversight interactions' as a distinct obligation without defined substitutes per contract.alternatives.
References
DORA: ICT third-party risk, concentration and register