[non-validated] DORA SFS E / SF 0 (Provider contracts, subcontracting and exit)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Have service providers established written ICT contracts with enforceable service levels, documented subcontractor oversight procedures, and validated exit strategies covering the preceding 12 months as specified in the DORA topic boundaries?
Explanation
[non-validated] This requirement mandates written ICT contracts with enforceable service levels, documented subcontractor oversight procedures, and tested exit arrangements as specified in the pinned DORA profile allocation. Evidence must cover the preceding 12 months and include measurable service levels (e.g., 99.95% uptime with penalties), approval logs, and validated recovery tests demonstrating fulfillment per the DORA profile scope.
Criterion and evidence
[non-validated] Applies to entities designated under the pinned DORA profile scope E. Requires contractual service levels with measurable metrics, documented subcontractor approval processes, and exit strategies validated through recovery testing. Evidence period: preceding 12 months. Pass: explicit clauses meeting DORA profile requirements for baseline functions. Fail: generic contractual references without measurable metrics or validation records. Pending: unsubmitted evidence. Repository references indicate alignment with DORA Articles 28 and 30, but provide no verified legal authority.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Provider contracts, subcontracting and exit. Maintain enforceable ICT contract controls, subcontracting oversight and tested exit arrangements. Cover contractual rights and obligations, service levels, locations/data access, audit/inspection rights, incident assistance, subcontracting changes and termination/exit strategies. Distinguish additional requirements for critical or important functions from baseline contract requirements. DORA article references: 28, 30. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence is required to satisfy this condition under the DORA profile?
Signed contracts specifying measurable service levels (e.g., 99.95% uptime with penalty terms), documented subcontractor oversight procedures showing regular approval reviews, and validated exit strategy evidence including recovery test reports. Based solely on pinned DORA profile definitions in repository topic scope E, not verified legal sources.
Can alternatives be accepted if formal documentation is missing according to the DORA profile?
No valid alternatives satisfy these requirements; prescribed elements (enforceable ICT contract controls, subcontracting oversight, tested exit arrangements) are mandatory per the pinned DORA profile scope. Generic contractual references without technical implementation details are insufficient.
References
DORA: Provider contracts, subcontracting and exit