[non-validated] DORA Area E: Provider Contracts, Subcontracting and Exit Strategies - Condition 1
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Have ICT service contracts established tested exit strategies for subcontracting arrangements as required by DORA Articles 28 and 30?
Explanation
[non-validated] Does the organization maintain tested exit strategies for ICT service subcontracting arrangements as required by DORA Articles 28 and 30?
Criterion and evidence
Verify existence of documented and tested exit strategies covering ICT subcontracting arrangements per DORA Articles 28 and 30. Evidence must include successful recovery scenario execution within the 12-month review period for designated digital operational resilience service providers.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Provider contracts, subcontracting and exit. Maintain enforceable ICT contract controls, subcontracting oversight and tested exit arrangements. Cover contractual rights and obligations, service levels, locations/data access, audit/inspection rights, incident assistance, subcontracting changes and termination/exit strategies. Distinguish additional requirements for critical or important functions from baseline contract requirements. DORA article references: 28, 30. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this requirement?
Documented exit strategy with evidence of successful recovery scenario execution specifically addressing subcontracting arrangements within the 12-month review period. Test logs demonstrating full data restoration within operational timeframes are required.
How is missing evidence handled?
Missing test results or validation documentation leaves the assessment status as 'pending'; contractual commitments without evidence of actual testing do not satisfy DORA requirements.
Are there acceptable alternatives to the documented testing?
No valid alternatives exist; tested exit arrangements for subcontracting are mandatory under DORA with no acceptable substitutions per Article 28 requirements.
References
DORA: Provider contracts, subcontracting and exit